From: David B. Robins Date: Wed, 30 Sep 2015 20:20:04 +0000 (-0400) Subject: net: usb: asix: Fix crash on skb alloc failure X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=f6194bcf03e40bc6b6094f11289d87b605fb326d;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git net: usb: asix: Fix crash on skb alloc failure If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will return but not clear rx->size. rx points to driver private data. A later call assumes that nonzero size means ax_skb was allocated and passes a null ax_skb to skb_put. Changed allocation failure return to clear size first. Found testing board with AX88772B devices. Signed-off-by: David B. Robins Signed-off-by: David S. Miller --- diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 75d6f26729a3..079069a060a6 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -91,8 +91,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, } rx->ax_skb = netdev_alloc_skb_ip_align(dev->net, rx->size); - if (!rx->ax_skb) + if (!rx->ax_skb) { + rx->size = 0; return 0; + } } if (rx->size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) {