| From foo@baz Sat Apr 16 22:36:37 PDT 2016 |
| From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| Date: Tue, 8 Mar 2016 01:36:28 +0300 |
| Subject: sh_eth: fix NULL pointer dereference in sh_eth_ring_format() |
| Status: RO |
| Content-Length: 1101 |
| Lines: 30 |
| |
| From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| |
| [ Upstream commit c1b7fca65070bfadca94dd53a4e6b71cd4f69715 ] |
| |
| In a low memory situation, if netdev_alloc_skb() fails on a first RX ring |
| loop iteration in sh_eth_ring_format(), 'rxdesc' is still NULL. Avoid |
| kernel oops by adding the 'rxdesc' check after the loop. |
| |
| Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com> |
| Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ethernet/renesas/sh_eth.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/ethernet/renesas/sh_eth.c |
| +++ b/drivers/net/ethernet/renesas/sh_eth.c |
| @@ -1156,7 +1156,8 @@ static void sh_eth_ring_format(struct ne |
| mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); |
| |
| /* Mark the last entry as wrapping the ring. */ |
| - rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); |
| + if (rxdesc) |
| + rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); |
| |
| memset(mdp->tx_ring, 0, tx_ringsize); |
| |
