Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac90a149 authored by Kyle McMartin's avatar Kyle McMartin Committed by David S. Miller
Browse files

tulip: Fix null dereference in uli526x_rx_packet() 



Acked-by: default avatarGrant Grundler <grundler@parisc-linux.org>

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a6d36d56

drivers/net/tulip/uli526x.c

+5 −3
Original line number Diff line number Diff line
@@ -851,13 +851,15 @@ static void uli526x_rx_packet(struct net_device *dev, struct uli526x_board_info 


			if ( !(rdes0 & 0x8000) ||

				((db->cr6_data & CR6_PM) && (rxlen>6)) ) {

				struct sk_buff *new_skb = NULL;



				skb = rxptr->rx_skb_ptr;



				/* Good packet, send to upper layer */

				/* Shorst packet used new SKB */

				if ((rxlen < RX_COPY_SIZE) &&

					( (skb = dev_alloc_skb(rxlen + 2) )

					!= NULL) ) {

				    ((new_skb = dev_alloc_skb(rxlen + 2) != NULL))) {

					skb = new_skb;

					/* size less than COPY_SIZE, allocate a rxlen SKB */

					skb_reserve(skb, 2); /* 16byte align */

					memcpy(skb_put(skb, rxlen),