netdev - dl2k: potential null dereference in recieve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 19 Jul 2009 14:59:24 +0300 (EAT)
From:	Dan Carpenter <error27@...il.com>
To:	netdev@...r.kernel.org
Subject: dl2k: potential null dereference in recieve_packet() 

Hello,

Smatch (http://repo.or.cz/w/smatch.git) found a potential null dereference 
in drivers/net/dl2k.c receive_packet().  If the allocation on line 874 
fails we still dereference skb on line 890.

drivers/net/dl2k.c 
   874                          } else if ((skb = netdev_alloc_skb(dev, pkt_len + 2))) {
   875                                  pci_dma_sync_single_for_cpu(np->pdev,
   876                                                              desc_to_dma(desc),
   877                                                              np->rx_buf_sz,
   878                                                              PCI_DMA_FROMDEVICE);
   879                                  /* 16 byte align the IP header */
   880                                  skb_reserve (skb, 2);
   881                                  skb_copy_to_linear_data (skb,
   882                                                    np->rx_skbuff[entry]->data,
   883                                                    pkt_len);
   884                                  skb_put (skb, pkt_len);
   885                                  pci_dma_sync_single_for_device(np->pdev,
   886                                                                 desc_to_dma(desc),
   887                                                                 np->rx_buf_sz,
   888                                                                 PCI_DMA_FROMDEVICE);
   889                          }
   890                          skb->protocol = eth_type_trans (skb, dev);

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html