netdev - [PATCH] net: sh_eth: avoid NULL pointer dereference in ring setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed,  2 Mar 2016 16:26:06 +0100
From:	Wolfram Sang <wsa@...-dreams.de>
To:	netdev@...r.kernel.org
Cc:	Wolfram Sang <wsa@...-dreams.de>,
	Simon Horman <horms@...ge.net.au>,
	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>,
	linux-renesas-soc@...r.kernel.org
Subject: [PATCH] net: sh_eth: avoid NULL pointer dereference in ring setup

From: Wolfram Sang <wsa+renesas@...g-engineering.com>

When allocating an skb fails, rxdesc is still NULL (or the previous ring
index on further iterations of the loop). However, this pointer is
dereferenced after the loop. So, make sure rxdesc is updated immediately
at the beginning of the loop.

Reported-by: coverity (CID 1056464)
Signed-off-by: Wolfram Sang <wsa+renesas@...g-engineering.com>
---
 drivers/net/ethernet/renesas/sh_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index a2767336b7c545..d5f13d54099734 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1120,6 +1120,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
 
 	/* build Rx ring buffer */
 	for (i = 0; i < mdp->num_rx_ring; i++) {
+		rxdesc = &mdp->rx_ring[i];
 		/* skb */
 		mdp->rx_skbuff[i] = NULL;
 		skb = netdev_alloc_skb(ndev, skbuff_size);
@@ -1128,7 +1129,6 @@ static void sh_eth_ring_format(struct net_device *ndev)
 		sh_eth_set_receive_align(skb);
 
 		/* RX descriptor */
-		rxdesc = &mdp->rx_ring[i];
 		/* The size of the buffer is a multiple of 32 bytes. */
 		buf_len = ALIGN(mdp->rx_buf_sz, 32);
 		rxdesc->len = cpu_to_le32(buf_len << 16);
-- 
2.7.0