Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 46798c89 authored by Jesper Juhl's avatar Jesper Juhl Committed by Jeff Garzik
Browse files

[PATCH] fix possible NULL ptr deref in forcedeth 



There seems to be a possible NULL pointer deref bug in
drivers/net/forcedeth.c::nv_loopback_test().  If dev_alloc_skb() fails, the
next line will call skb_put() with a NULL first argument which it'll then
try to deref - kaboom: a NULL pointer deref.  Found by coverity (#1337).

Signed-off-by: default avatarJesper Juhl <jesper.juhl@gmail.com>
Cc: Ayaz Abdulla <aabdulla@nvidia.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Stephen Hemminger <shemminger@osdl.org>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent 84c22d79

drivers/net/forcedeth.c

+7 −1
Original line number Diff line number Diff line
@@ -3789,6 +3789,12 @@ static int nv_loopback_test(struct net_device *dev) 
	/* setup packet for tx */

	pkt_len = ETH_DATA_LEN;

	tx_skb = dev_alloc_skb(pkt_len);

	if (!tx_skb) {

		printk(KERN_ERR "dev_alloc_skb() failed during loopback test"

			 " of %s\n", dev->name);

		ret = 0;

		goto out;

	}

	pkt_data = skb_put(tx_skb, pkt_len);

	for (i = 0; i < pkt_len; i++)

		pkt_data[i] = (u8)(i & 0xff);
@@ -3853,7 +3859,7 @@ static int nv_loopback_test(struct net_device *dev) 
		       tx_skb->end-tx_skb->data,

		       PCI_DMA_TODEVICE);

	dev_kfree_skb_any(tx_skb);



 out:

	/* stop engines */

	nv_stop_rx(dev);

	nv_stop_tx(dev);