diff mbox

[net-next] net: stmmac: fix NULL pointer dereference in stmmac_get_tx_hwtstamp

Message ID 1389795967-2452-1-git-send-email-damuzi000@gmail.com
State Changes Requested, archived
Delegated to: David Miller
Headers show

Commit Message

damuzi000 Jan. 15, 2014, 2:26 p.m. UTC
When timestamping is enabled, stmmac_tx_clean will call
stmmac_get_tx_hwtstamp to get tx TS.
But the skb can be NULL because the last of its tx_skbuff is NULL
if this packet frame is filled in more than one descriptors.

Signed-off-by: Bruce Liu <damuzi000@gmail.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

David Miller Jan. 16, 2014, 12:58 a.m. UTC | #1
From: Bruce Liu <damuzi000@gmail.com>
Date: Wed, 15 Jan 2014 22:26:07 +0800

> When timestamping is enabled, stmmac_tx_clean will call
> stmmac_get_tx_hwtstamp to get tx TS.
> But the skb can be NULL because the last of its tx_skbuff is NULL
> if this packet frame is filled in more than one descriptors.
> 
> Signed-off-by: Bruce Liu <damuzi000@gmail.com>

Sometimes the cure is worse than the disease.

Your change means that every multi-segment packet will never have
it's timestamp properly recorded, which is of course bogus.

You need to change this code such that the SKB from the first
descriptor is maintained so that we can pass it into
stmmac_get_tx_hwtstamp() at the appropriate time.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 797b56a..47f2287 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -332,7 +332,7 @@  static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
 		return;
 
 	/* exit if skb doesn't support hw tstamp */
-	if (likely(!(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
+	if (likely(!skb || !(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
 		return;
 
 	if (priv->adv_ts)