Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1388425
| Path | csiph.com!news.mixmin.net!aioe.org!gothmog.csi.it!bofh.it!news.nic.it!robomod |
|---|---|
| From | Ben Hutchings <ben@decadent.org.uk> |
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.16 203/217] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() |
| Date | Wed, 27 Apr 2016 02:20:01 +0200 |
| Message-ID | <rslmV-92-5@gated-at.bofh.it> (permalink) |
| References | <rskqR-7Qj-3@gated-at.bofh.it> |
| Content-Type | text/plain; charset="UTF-8" |
| Content-Disposition | inline |
| Content-Transfer-Encoding | 8bit |
| MIME-Version | 1.0 |
| X-Mailer | LinuxStableQueue (scripts by bwh) |
| X-Sa-Exim-Connect-IP | 2a02:8426:ae4:c500:9cba:69ae:962d:6167 |
| X-Sa-Exim-Mail-From | ben@decadent.org.uk |
| X-Sa-Exim-Scanned | No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 32 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | akpm@linux-foundation.org, "Wolfram Sang" <wsa+renesas@sang-engineering.com>, "Sergei Shtylyov" <sergei.shtylyov@cogentembedded.com>, "David S. Miller" <davem@davemloft.net> |
| X-Original-Date | Wed, 27 Apr 2016 01:02:21 +0200 |
| X-Original-Message-ID | <lsq.1461711741.128696931@decadent.org.uk> |
| X-Original-References | <lsq.1461711740.434915673@decadent.org.uk> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1388425 |
Show key headers only | View raw
3.16.35-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> [ Upstream commit c1b7fca65070bfadca94dd53a4e6b71cd4f69715 ] In a low memory situation, if netdev_alloc_skb() fails on a first RX ring loop iteration in sh_eth_ring_format(), 'rxdesc' is still NULL. Avoid kernel oops by adding the 'rxdesc' check after the loop. Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- drivers/net/ethernet/renesas/sh_eth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/renesas/sh_eth.c +++ b/drivers/net/ethernet/renesas/sh_eth.c @@ -1162,7 +1162,8 @@ static void sh_eth_ring_format(struct ne mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); /* Mark the last entry as wrapping the ring. */ - rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); + if (rxdesc) + rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); memset(mdp->tx_ring, 0, tx_ringsize);
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH 3.16 203/217] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() Ben Hutchings <ben@decadent.org.uk> - 2016-04-27 02:20 +0200
csiph-web