[prev in list] [next in list] [prev in thread] [next in thread] 

List:       git-commits-head
Subject:    net: dp83640: Avoid NULL pointer dereference.
From:       "Linux Kernel Mailing List" <linux-kernel () vger ! kernel ! org>
Date:       2017-06-29 21:34:35
Message-ID: 20170629213435.95F9422D7A () pdx-korg-gitolite-1 ! ci ! codeaurora ! org
[Download RAW message or body]

Web:        https://git.kernel.org/torvalds/c/db9d8b29d19d2801793e4419f4c6272bf8951c62
Commit:     db9d8b29d19d2801793e4419f4c6272bf8951c62
Parent:     43b786c6765945310cabc61a5e29b97ced85f7f0
Refname:    refs/heads/master
Author:     Richard Cochran <richardcochran@gmail.com>
AuthorDate: Fri Jun 23 17:51:31 2017 +0200
Committer:  David S. Miller <davem@davemloft.net>
CommitDate: Fri Jun 23 14:38:16 2017 -0400

    net: dp83640: Avoid NULL pointer dereference.
    
    The function, skb_complete_tx_timestamp(), used to allow passing in a
    NULL pointer for the time stamps, but that was changed in commit
    62bccb8cdb69051b95a55ab0c489e3cab261c8ef ("net-timestamp: Make the
    clone operation stand-alone from phy timestamping"), and the existing
    call sites, all of which are in the dp83640 driver, were fixed up.
    
    Even though the kernel-doc was subsequently updated in commit
    7a76a021cd5a292be875fbc616daf03eab1e6996 ("net-timestamp: Update
    skb_complete_tx_timestamp comment"), still a bug fix from Manfred
    Rudigier came into the driver using the old semantics.  Probably
    Manfred derived that patch from an older kernel version.
    
    This fix should be applied to the stable trees as well.
    
    Fixes: 81e8f2e930fe ("net: dp83640: Fix tx timestamp overflow handling.")
    Signed-off-by: Richard Cochran <richardcochran@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
---
 drivers/net/phy/dp83640.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index ed0d10f54f26..c3065236ffcc 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -908,7 +908,7 @@ static void decode_txts(struct dp83640_private *dp83640,
 	if (overflow) {
 		pr_debug("tx timestamp queue overflow, count %d\n", overflow);
 		while (skb) {
-			skb_complete_tx_timestamp(skb, NULL);
+			kfree_skb(skb);
 			skb = skb_dequeue(&dp83640->tx_queue);
 		}
 		return;
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]