[PATCH net-next] net: stmmac: fix NULL pointer dereference in stmmac_get_tx_hwtstamp

[PATCH net-next] net: stmmac: fix NULL pointer dereference in stmmac_get_tx_hwtstamp

[Bruce Liu]

When timestamping is enabled, stmmac_tx_clean will call
stmmac_get_tx_hwtstamp to get tx TS.
But the skb can be NULL because the last of its tx_skbuff is NULL
if this packet frame is filled in more than one descriptors.

Signed-off-by: Bruce Liu <damuzi000@gmail.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 797b56a..47f2287 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -332,7 +332,7 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
 		return;
 
 	/* exit if skb doesn't support hw tstamp */
-	if (likely(!(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
+	if (likely(!skb || !(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)))
 		return;
 
 	if (priv->adv_ts)
-- 
1.7.9.5

Re: [PATCH net-next] net: stmmac: fix NULL pointer dereference in stmmac_get_tx_hwtstamp

[David Miller]

From: Bruce Liu <damuzi000@gmail.com>
Date: Wed, 15 Jan 2014 22:26:07 +0800

> When timestamping is enabled, stmmac_tx_clean will call
> stmmac_get_tx_hwtstamp to get tx TS.
> But the skb can be NULL because the last of its tx_skbuff is NULL
> if this packet frame is filled in more than one descriptors.
> 
> Signed-off-by: Bruce Liu <damuzi000@gmail.com>

Sometimes the cure is worse than the disease.

Your change means that every multi-segment packet will never have
it's timestamp properly recorded, which is of course bogus.

You need to change this code such that the SKB from the first
descriptor is maintained so that we can pass it into
stmmac_get_tx_hwtstamp() at the appropriate time.

Thanks.