diff options
author | Jesper Juhl <jesper.juhl@gmail.com> | 2006-05-10 02:14:35 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2006-05-10 02:14:35 -0400 |
commit | a50bb7b9af9a7c39b2aba15678eb686ae428718c (patch) | |
tree | f741922e4dbc4920548d7d4b68cf5eb37c11f85e | |
parent | 8c1056839e808aad728db86d739ffec71d2d1db8 (diff) |
[TG3]: Fix possible NULL deref in tg3_run_loopback().
tg3_run_loopback doesn't check that dev_alloc_skb() returns anything
useful.
Even if dev_alloc_skb() fails to return an skb to us we'll happily go
on and assume it did, so we risk dereferencing a NULL pointer. Much
better to fail gracefully by returning -ENOMEM than crashing here.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | drivers/net/tg3.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index beeb612be98f..2bd9592b75cd 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c | |||
@@ -8454,6 +8454,9 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode) | |||
8454 | 8454 | ||
8455 | tx_len = 1514; | 8455 | tx_len = 1514; |
8456 | skb = dev_alloc_skb(tx_len); | 8456 | skb = dev_alloc_skb(tx_len); |
8457 | if (!skb) | ||
8458 | return -ENOMEM; | ||
8459 | |||
8457 | tx_data = skb_put(skb, tx_len); | 8460 | tx_data = skb_put(skb, tx_len); |
8458 | memcpy(tx_data, tp->dev->dev_addr, 6); | 8461 | memcpy(tx_data, tp->dev->dev_addr, 6); |
8459 | memset(tx_data + 6, 0x0, 8); | 8462 | memset(tx_data + 6, 0x0, 8); |