Skip to content

Commit

Permalink
[TG3]: Fix possible NULL deref in tg3_run_loopback().
Browse files Browse the repository at this point in the history
tg3_run_loopback doesn't check that dev_alloc_skb() returns anything
useful.

Even if dev_alloc_skb() fails to return an skb to us we'll happily go
on and assume it did, so we risk dereferencing a NULL pointer.  Much
better to fail gracefully by returning -ENOMEM than crashing here.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Jesper Juhl authored and David S. Miller committed May 10, 2006
1 parent 8c10568 commit a50bb7b
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/net/tg3.c
Original file line number Diff line number Diff line change
Expand Up @@ -8454,6 +8454,9 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)

tx_len = 1514;
skb = dev_alloc_skb(tx_len);
if (!skb)
return -ENOMEM;

tx_data = skb_put(skb, tx_len);
memcpy(tx_data, tp->dev->dev_addr, 6);
memset(tx_data + 6, 0x0, 8);
Expand Down

0 comments on commit a50bb7b

Please sign in to comment.