summaryrefslogtreecommitdiff
path: root/drivers/net/forcedeth.c
diff options
context:
space:
mode:
authorJesper Juhl <jesper.juhl@gmail.com>2006-09-25 16:39:24 -0700
committerJeff Garzik <jeff@garzik.org>2006-09-25 20:01:19 -0400
commit46798c897e235e71e1e9c46a5e6e9adfffd8b85d (patch)
treea43e0781a3d2076321b19fc47ba2791e180e6860 /drivers/net/forcedeth.c
parent84c22d7901f793bd267b5f79270080964b252826 (diff)
[PATCH] fix possible NULL ptr deref in forcedeth
There seems to be a possible NULL pointer deref bug in drivers/net/forcedeth.c::nv_loopback_test(). If dev_alloc_skb() fails, the next line will call skb_put() with a NULL first argument which it'll then try to deref - kaboom: a NULL pointer deref. Found by coverity (#1337). Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Cc: Ayaz Abdulla <aabdulla@nvidia.com> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: Stephen Hemminger <shemminger@osdl.org> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/forcedeth.c')
-rw-r--r--drivers/net/forcedeth.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 97db910fbc8c..eea1d66c530e 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3789,6 +3789,12 @@ static int nv_loopback_test(struct net_device *dev)
/* setup packet for tx */
pkt_len = ETH_DATA_LEN;
tx_skb = dev_alloc_skb(pkt_len);
+ if (!tx_skb) {
+ printk(KERN_ERR "dev_alloc_skb() failed during loopback test"
+ " of %s\n", dev->name);
+ ret = 0;
+ goto out;
+ }
pkt_data = skb_put(tx_skb, pkt_len);
for (i = 0; i < pkt_len; i++)
pkt_data[i] = (u8)(i & 0xff);
@@ -3853,7 +3859,7 @@ static int nv_loopback_test(struct net_device *dev)
tx_skb->end-tx_skb->data,
PCI_DMA_TODEVICE);
dev_kfree_skb_any(tx_skb);
-
+ out:
/* stop engines */
nv_stop_rx(dev);
nv_stop_tx(dev);