diff options
| author | David B. Robins <linux@davidrobins.net> | 2015-09-30 22:20:04 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-10-05 12:31:27 +0200 |
| commit | f6194bcf03e40bc6b6094f11289d87b605fb326d (patch) | |
| tree | 6d816a477b38af6e4cce7cda214fc17589c0b57a /drivers/net/usb | |
| parent | Merge tag 'linux-can-fixes-for-4.3-20150930' of git://git.kernel.org/pub/scm/... (diff) | |
| download | linux-f6194bcf03e40bc6b6094f11289d87b605fb326d.tar.xz linux-f6194bcf03e40bc6b6094f11289d87b605fb326d.zip | |
net: usb: asix: Fix crash on skb alloc failure
If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will return
but not clear rx->size. rx points to driver private data. A later call
assumes that nonzero size means ax_skb was allocated and passes a null
ax_skb to skb_put. Changed allocation failure return to clear size first.
Found testing board with AX88772B devices.
Signed-off-by: David B. Robins <linux@davidrobins.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/usb')
| -rw-r--r-- | drivers/net/usb/asix_common.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 75d6f26729a3..079069a060a6 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -91,8 +91,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, } rx->ax_skb = netdev_alloc_skb_ip_align(dev->net, rx->size); - if (!rx->ax_skb) + if (!rx->ax_skb) { + rx->size = 0; return 0; + } } if (rx->size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) { |