net: avoid NULL deref in napi_get_frags()

edumazet · davem330 · commit e2f9dc3bd213 · 2015-11-20T16:43:14.000-05:00
napi_alloc_skb() can return NULL. We should not crash should this happen. Fixes: 93f93a4 ("net: move skb_mark_napi_id() into core networking stack") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -4390,8 +4390,10 @@ struct sk_buff *napi_get_frags(struct napi_struct *napi)
 
 	if (!skb) {
 		skb = napi_alloc_skb(napi, GRO_MAX_HEAD);
-		napi->skb = skb;
-		skb_mark_napi_id(skb, napi);
+		if (skb) {
+			napi->skb = skb;
+			skb_mark_napi_id(skb, napi);
+		}
 	}
 	return skb;
 }

Original file line number	Diff line number	Diff line change
`@@ -4390,8 +4390,10 @@ struct sk_buff napi_get_frags(struct napi_struct napi)`
`4390`	`4390`
`4391`	`4391`	`if (!skb) {`
`4392`	`4392`	`skb = napi_alloc_skb(napi, GRO_MAX_HEAD);`
`4393`		`- napi->skb = skb;`
`4394`		`- skb_mark_napi_id(skb, napi);`
	`4393`	`+ if (skb) {`
	`4394`	`+ napi->skb = skb;`
	`4395`	`+ skb_mark_napi_id(skb, napi);`
	`4396`	`+ }`
`4395`	`4397`	`}`
`4396`	`4398`	`return skb;`
`4397`	`4399`	`}`