We dereference "qi" before checking whether it is NULL. There is one
error path in create_queue() which passes a NULL to destroy_queue() so
this could result in a NULL pointer dereference.
Fixes: ad1f62ab2bd4 ("High Performance UML Vector Network Driver")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
index bb83a2d22ac2..5219c37b8d03 100644
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -455,11 +455,12 @@ static void destroy_queue(struct vector_queue *qi)
{
int i;
struct iovec *iov;
- struct vector_private *vp = netdev_priv(qi->dev);
+ struct vector_private *vp;
struct mmsghdr *mmsg_vector;
if (qi == NULL)
return;
+ vp = netdev_priv(qi->dev);
/* deallocate any skbuffs - we rely on any unused to be
* set to NULL.
*/
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
