From 75e4364f67d9cb996f9a6ff982ad9b3700648591 Mon Sep 17 00:00:00 2001 From: damuzi000 Date: Fri, 17 Jan 2014 23:47:59 +0800 Subject: net: stmmac: fix NULL pointer dereference in stmmac_get_tx_hwtstamp When timestamping is enabled, stmmac_tx_clean will call stmmac_get_tx_hwtstamp to get tx TS. But the skb can be NULL because the last of its tx_skbuff is NULL if this packet frame is filled in more than one descriptors. To fix the issue, change the code: - Store TX skb to the tx_skbuff[] of frame's last segment. - Check skb is not NULL in stmmac_get_tx_hwtstamp. Signed-off-by: Bruce Liu Signed-off-by: David S. Miller --- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers/net/ethernet/stmicro/stmmac/chain_mode.c') diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c index d234ab540b29..72d282bf33a5 100644 --- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c +++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c @@ -51,6 +51,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum) priv->hw->desc->prepare_tx_desc(desc, 1, bmax, csum, STMMAC_CHAIN_MODE); while (len != 0) { + priv->tx_skbuff[entry] = NULL; entry = (++priv->cur_tx) % txsize; desc = priv->dma_tx + entry; @@ -62,7 +63,6 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum) priv->hw->desc->prepare_tx_desc(desc, 0, bmax, csum, STMMAC_CHAIN_MODE); priv->hw->desc->set_tx_owner(desc); - priv->tx_skbuff[entry] = NULL; len -= bmax; i++; } else { @@ -73,7 +73,6 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum) priv->hw->desc->prepare_tx_desc(desc, 0, len, csum, STMMAC_CHAIN_MODE); priv->hw->desc->set_tx_owner(desc); - priv->tx_skbuff[entry] = NULL; len = 0; } } -- cgit v1.2.3