Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a50bb7b9 authored by Jesper Juhl's avatar Jesper Juhl Committed by David S. Miller
Browse files

[TG3]: Fix possible NULL deref in tg3_run_loopback(). 



tg3_run_loopback doesn't check that dev_alloc_skb() returns anything
useful.

Even if dev_alloc_skb() fails to return an skb to us we'll happily go
on and assume it did, so we risk dereferencing a NULL pointer.  Much
better to fail gracefully by returning -ENOMEM than crashing here.

Signed-off-by: default avatarJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8c105683

drivers/net/tg3.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -8454,6 +8454,9 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode) 




	tx_len = 1514;

	tx_len = 1514;

	skb = dev_alloc_skb(tx_len);

	skb = dev_alloc_skb(tx_len);

	if (!skb)

		return -ENOMEM;



	tx_data = skb_put(skb, tx_len);

	tx_data = skb_put(skb, tx_len);

	memcpy(tx_data, tp->dev->dev_addr, 6);

	memcpy(tx_data, tp->dev->dev_addr, 6);

	memset(tx_data + 6, 0x0, 8);

	memset(tx_data + 6, 0x0, 8);