diff mbox

hdlc: fix null-deref on allocation failure

Message ID 20151117142606.4a0ca2d1@samsung9
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

stephen hemminger Nov. 17, 2015, 10:26 p.m. UTC
If alloc_netdev() failed and return NULL, then the next instruction
would dereference it. Found by Coverity.

Compile tested only. Not sure if anyone still uses this driver
(or the whole WAN subsystem).

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Miller Nov. 18, 2015, 8:06 p.m. UTC | #1
From: Stephen Hemminger <shemming@brocade.com>
Date: Tue, 17 Nov 2015 14:26:06 -0800

> If alloc_netdev() failed and return NULL, then the next instruction
> would dereference it. Found by Coverity.
> 
> Compile tested only. Not sure if anyone still uses this driver
> (or the whole WAN subsystem).
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

--- a/drivers/net/wan/hdlc_fr.c	2015-08-18 17:45:21.414525304 -0700
+++ b/drivers/net/wan/hdlc_fr.c	2015-11-16 09:50:07.317597825 -0800
@@ -1075,11 +1075,10 @@  static int fr_add_pvc(struct net_device
 
 	used = pvc_is_used(pvc);
 
-	if (type == ARPHRD_ETHER) {
+	if (type == ARPHRD_ETHER)
 		dev = alloc_netdev(0, "pvceth%d", NET_NAME_UNKNOWN,
 				   ether_setup);
-		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
-	} else
+	else
 		dev = alloc_netdev(0, "pvc%d", NET_NAME_UNKNOWN, pvc_setup);
 
 	if (!dev) {
@@ -1088,9 +1087,10 @@  static int fr_add_pvc(struct net_device
 		return -ENOBUFS;
 	}
 
-	if (type == ARPHRD_ETHER)
+	if (type == ARPHRD_ETHER) {
+		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 		eth_hw_addr_random(dev);
-	else {
+	} else {
 		*(__be16*)dev->dev_addr = htons(dlci);
 		dlci_to_q922(dev->broadcast, dlci);
 	}