diff options
| author |   Jesper Juhl <jesper.juhl@gmail.com> | 2006-09-25 16:39:24 -0700 |
|---|---|---|
| committer |   Jeff Garzik <jeff@garzik.org> | 2006-09-25 20:01:19 -0400 |
| commit | 46798c897e235e71e1e9c46a5e6e9adfffd8b85d (patch) | |
| tree | a43e0781a3d2076321b19fc47ba2791e180e6860 /drivers/net/forcedeth.c | |
| parent | [PATCH] Signedness issue in drivers/net/phy/phy_device.c (diff) | |
| download | linux-dev-46798c897e235e71e1e9c46a5e6e9adfffd8b85d.tar.xz linux-dev-46798c897e235e71e1e9c46a5e6e9adfffd8b85d.zip | |
[PATCH] fix possible NULL ptr deref in forcedeth
There seems to be a possible NULL pointer deref bug in
drivers/net/forcedeth.c::nv_loopback_test(). If dev_alloc_skb() fails, the
next line will call skb_put() with a NULL first argument which it'll then
try to deref - kaboom: a NULL pointer deref. Found by coverity (#1337).
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Cc: Ayaz Abdulla <aabdulla@nvidia.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Stephen Hemminger <shemminger@osdl.org>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/forcedeth.c')
| -rw-r--r-- | drivers/net/forcedeth.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c index 97db910fbc8c..eea1d66c530e 100644 --- a/drivers/net/forcedeth.c +++ b/drivers/net/forcedeth.c @@ -3789,6 +3789,12 @@ static int nv_loopback_test(struct net_device *dev) /* setup packet for tx */ pkt_len = ETH_DATA_LEN; tx_skb = dev_alloc_skb(pkt_len); + if (!tx_skb) { + printk(KERN_ERR "dev_alloc_skb() failed during loopback test" + " of %s\n", dev->name); + ret = 0; + goto out; + } pkt_data = skb_put(tx_skb, pkt_len); for (i = 0; i < pkt_len; i++) pkt_data[i] = (u8)(i & 0xff); @@ -3853,7 +3859,7 @@ static int nv_loopback_test(struct net_device *dev) tx_skb->end-tx_skb->data, PCI_DMA_TODEVICE); dev_kfree_skb_any(tx_skb); - + out: /* stop engines */ nv_stop_rx(dev); nv_stop_tx(dev); |