From patchwork Wed Mar 2 15:26:06 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wolfram Sang X-Patchwork-Id: 8481941 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: X-Original-To: patchwork-linux-renesas-soc@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 70A3D9F2F0 for ; Wed, 2 Mar 2016 15:26:33 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D7A8020386 for ; Wed, 2 Mar 2016 15:26:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3951420383 for ; Wed, 2 Mar 2016 15:26:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755323AbcCBP0X (ORCPT ); Wed, 2 Mar 2016 10:26:23 -0500 Received: from sauhun.de ([89.238.76.85]:50158 "EHLO pokefinder.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754309AbcCBP0W (ORCPT ); Wed, 2 Mar 2016 10:26:22 -0500 Received: from p5082e975.dip0.t-ipconnect.de ([80.130.233.117]:43996 helo=localhost) by pokefinder.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1ab8fI-0005s9-L7; Wed, 02 Mar 2016 16:26:16 +0100 From: Wolfram Sang To: netdev@vger.kernel.org Cc: Wolfram Sang , Simon Horman , Sergei Shtylyov , linux-renesas-soc@vger.kernel.org Subject: [PATCH] net: sh_eth: avoid NULL pointer dereference in ring setup Date: Wed, 2 Mar 2016 16:26:06 +0100 Message-Id: <1456932370-4143-1-git-send-email-wsa@the-dreams.de> X-Mailer: git-send-email 2.7.0 Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wolfram Sang When allocating an skb fails, rxdesc is still NULL (or the previous ring index on further iterations of the loop). However, this pointer is dereferenced after the loop. So, make sure rxdesc is updated immediately at the beginning of the loop. Reported-by: coverity (CID 1056464) Signed-off-by: Wolfram Sang Reported-by: Wolfram Sang --- drivers/net/ethernet/renesas/sh_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c index a2767336b7c545..d5f13d54099734 100644 --- a/drivers/net/ethernet/renesas/sh_eth.c +++ b/drivers/net/ethernet/renesas/sh_eth.c @@ -1120,6 +1120,7 @@ static void sh_eth_ring_format(struct net_device *ndev) /* build Rx ring buffer */ for (i = 0; i < mdp->num_rx_ring; i++) { + rxdesc = &mdp->rx_ring[i]; /* skb */ mdp->rx_skbuff[i] = NULL; skb = netdev_alloc_skb(ndev, skbuff_size); @@ -1128,7 +1129,6 @@ static void sh_eth_ring_format(struct net_device *ndev) sh_eth_set_receive_align(skb); /* RX descriptor */ - rxdesc = &mdp->rx_ring[i]; /* The size of the buffer is a multiple of 32 bytes. */ buf_len = ALIGN(mdp->rx_buf_sz, 32); rxdesc->len = cpu_to_le32(buf_len << 16);