A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

[PATCH] fix possible NULL ptr deref in forcedeth

Browse source 
There seems to be a possible NULL pointer deref bug in
drivers/net/forcedeth.c::nv_loopback_test().  If dev_alloc_skb() fails, the
next line will call skb_put() with a NULL first argument which it'll then
try to deref - kaboom: a NULL pointer deref.  Found by coverity (#1337).

Signed-off-by: Jesper Juhl <[email protected]>
Cc: Ayaz Abdulla <[email protected]>
Cc: Manfred Spraul <[email protected]>
Cc: Stephen Hemminger <[email protected]>
Cc: Jeff Garzik <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
This commit is contained in:
Jesper Juhl 2006-09-25 16:39:24 -07:00 • committed by Jeff Garzik
commit 46798c897e
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/net/forcedeth.c
View file

@ -3789,6 +3789,12 @@ static int nv_loopback_test(struct net_device *dev)
/* setup packet for tx */
pkt_len = ETH_DATA_LEN;
tx_skb = dev_alloc_skb(pkt_len);
if (!tx_skb) {
printk(KERN_ERR "dev_alloc_skb() failed during loopback test"
" of %s\n", dev->name);
ret = 0;
goto out;
}
pkt_data = skb_put(tx_skb, pkt_len);
for (i = 0; i < pkt_len; i++)
pkt_data[i] = (u8)(i & 0xff);
@ -3853,7 +3859,7 @@ static int nv_loopback_test(struct net_device *dev)
tx_skb->end-tx_skb->data,
PCI_DMA_TODEVICE);
dev_kfree_skb_any(tx_skb);
out:
/* stop engines */
nv_stop_rx(dev);
nv_stop_tx(dev);