From: Jesper Juhl <jesper.juhl@gmail.com>
Date: Wed, 10 May 2006 06:14:35 +0000 (-0700)
Subject: [TG3]: Fix possible NULL deref in tg3_run_loopback().
X-Git-Tag: v2.6.17-rc4~3^2~4
X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a50bb7b9af9a7c39b2aba15678eb686ae428718c;p=pandora-kernel.git

[TG3]: Fix possible NULL deref in tg3_run_loopback().

tg3_run_loopback doesn't check that dev_alloc_skb() returns anything
useful.

Even if dev_alloc_skb() fails to return an skb to us we'll happily go
on and assume it did, so we risk dereferencing a NULL pointer.  Much
better to fail gracefully by returning -ENOMEM than crashing here.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index beeb612be98f..2bd9592b75cd 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -8454,6 +8454,9 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
 
 	tx_len = 1514;
 	skb = dev_alloc_skb(tx_len);
+	if (!skb)
+		return -ENOMEM;
+
 	tx_data = skb_put(skb, tx_len);
 	memcpy(tx_data, tp->dev->dev_addr, 6);
 	memset(tx_data + 6, 0x0, 8);