The patch titled
fix possible NULL ptr deref in forcedeth
has been added to the -mm tree. Its filename is
fix-possible-null-ptr-deref-in-forcedeth.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: fix possible NULL ptr deref in forcedeth
From: Jesper Juhl <jesper.juhl@xxxxxxxxx>
There seems to be a possible NULL pointer deref bug in
drivers/net/forcedeth.c::nv_loopback_test(). If dev_alloc_skb() fails, the
next line will call skb_put() with a NULL first argument which it'll then
try to deref - kaboom: a NULL pointer deref. Found by coverity (#1337).
Signed-off-by: Jesper Juhl <jesper.juhl@xxxxxxxxx>
Cc: Ayaz Abdulla <aabdulla@xxxxxxxxxx>
Cc: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Cc: Stephen Hemminger <shemminger@xxxxxxxx>
Cc: Jeff Garzik <jeff@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/net/forcedeth.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletion(-)
diff -puN drivers/net/forcedeth.c~fix-possible-null-ptr-deref-in-forcedeth drivers/net/forcedeth.c
--- a/drivers/net/forcedeth.c~fix-possible-null-ptr-deref-in-forcedeth
+++ a/drivers/net/forcedeth.c
@@ -3752,6 +3752,12 @@ static int nv_loopback_test(struct net_d
/* setup packet for tx */
pkt_len = ETH_DATA_LEN;
tx_skb = dev_alloc_skb(pkt_len);
+ if (!tx_skb) {
+ printk(KERN_ERR "dev_alloc_skb() failed during loopback test"
+ " of %s\n", dev->name);
+ ret = 0;
+ goto out;
+ }
pkt_data = skb_put(tx_skb, pkt_len);
for (i = 0; i < pkt_len; i++)
pkt_data[i] = (u8)(i & 0xff);
@@ -3816,7 +3822,7 @@ static int nv_loopback_test(struct net_d
tx_skb->end-tx_skb->data,
PCI_DMA_TODEVICE);
dev_kfree_skb_any(tx_skb);
-
+ out:
/* stop engines */
nv_stop_rx(dev);
nv_stop_tx(dev);
_
Patches currently in -mm which might be from jesper.juhl@xxxxxxxxx are
fix-possible-null-ptr-deref-in-forcedeth.patch
add-netpoll-netconsole-support-to-vlan-devices.patch
small-update-to-credits.patch
debug-shared-irqs.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
