From 46798c897e235e71e1e9c46a5e6e9adfffd8b85d Mon Sep 17 00:00:00 2001 From: Jesper Juhl Date: Mon, 25 Sep 2006 16:39:24 -0700 Subject: [PATCH] [PATCH] fix possible NULL ptr deref in forcedeth There seems to be a possible NULL pointer deref bug in drivers/net/forcedeth.c::nv_loopback_test(). If dev_alloc_skb() fails, the next line will call skb_put() with a NULL first argument which it'll then try to deref - kaboom: a NULL pointer deref. Found by coverity (#1337). Signed-off-by: Jesper Juhl Cc: Ayaz Abdulla Cc: Manfred Spraul Cc: Stephen Hemminger Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/forcedeth.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c index 97db910fbc8c..eea1d66c530e 100644 --- a/drivers/net/forcedeth.c +++ b/drivers/net/forcedeth.c @@ -3789,6 +3789,12 @@ static int nv_loopback_test(struct net_device *dev) /* setup packet for tx */ pkt_len = ETH_DATA_LEN; tx_skb = dev_alloc_skb(pkt_len); + if (!tx_skb) { + printk(KERN_ERR "dev_alloc_skb() failed during loopback test" + " of %s\n", dev->name); + ret = 0; + goto out; + } pkt_data = skb_put(tx_skb, pkt_len); for (i = 0; i < pkt_len; i++) pkt_data[i] = (u8)(i & 0xff); @@ -3853,7 +3859,7 @@ static int nv_loopback_test(struct net_device *dev) tx_skb->end-tx_skb->data, PCI_DMA_TODEVICE); dev_kfree_skb_any(tx_skb); - + out: /* stop engines */ nv_stop_rx(dev); nv_stop_tx(dev); -- 2.20.1