diff options
| author | damuzi000 <damuzi000@gmail.com> | 2014-01-17 23:47:59 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-01-19 20:02:45 -0800 |
| commit | 75e4364f67d9cb996f9a6ff982ad9b3700648591 (patch) | |
| tree | 429b1772db926d6fe70a1cad56353d890c1e87b9 /drivers/net/ethernet/stmicro/stmmac/ring_mode.c | |
| parent | af0bd4e9ba809391f275d0c094ac0bfbfbb3f430 (diff) | |
net: stmmac: fix NULL pointer dereference in stmmac_get_tx_hwtstamp
When timestamping is enabled, stmmac_tx_clean will call
stmmac_get_tx_hwtstamp to get tx TS.
But the skb can be NULL because the last of its tx_skbuff is NULL
if this packet frame is filled in more than one descriptors.
To fix the issue, change the code:
- Store TX skb to the tx_skbuff[] of frame's last segment.
- Check skb is not NULL in stmmac_get_tx_hwtstamp.
Signed-off-by: Bruce Liu <damuzi000@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/stmicro/stmmac/ring_mode.c')
| -rw-r--r-- | drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c index 1ef9d8a555aa..a96c7c2f5f3f 100644 --- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c @@ -58,6 +58,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum) priv->hw->desc->prepare_tx_desc(desc, 1, bmax, csum, STMMAC_RING_MODE); wmb(); + priv->tx_skbuff[entry] = NULL; entry = (++priv->cur_tx) % txsize; if (priv->extend_desc) @@ -73,7 +74,6 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum) STMMAC_RING_MODE); wmb(); priv->hw->desc->set_tx_owner(desc); - priv->tx_skbuff[entry] = NULL; } else { desc->des2 = dma_map_single(priv->device, skb->data, nopaged_len, DMA_TO_DEVICE); |