lkml.org 
[lkml]   [2016]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 15/37] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

    [ Upstream commit c1b7fca65070bfadca94dd53a4e6b71cd4f69715 ]

    In a low memory situation, if netdev_alloc_skb() fails on a first RX ring
    loop iteration in sh_eth_ring_format(), 'rxdesc' is still NULL. Avoid
    kernel oops by adding the 'rxdesc' check after the loop.

    Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
    Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/renesas/sh_eth.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/net/ethernet/renesas/sh_eth.c
    +++ b/drivers/net/ethernet/renesas/sh_eth.c
    @@ -1156,7 +1156,8 @@ static void sh_eth_ring_format(struct ne
    mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);

    /* Mark the last entry as wrapping the ring. */
    - rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL);
    + if (rxdesc)
    + rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL);

    memset(mdp->tx_ring, 0, tx_ringsize);


    \
     
     \ /
      Last update: 2016-04-18 04:41    [W:4.292 / U:1.368 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site