net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
authorDaniel Borkmann <dborkman@redhat.com>
Tue, 13 Aug 2013 18:45:13 +0000 (11:45 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 15 Aug 2013 20:41:20 +0000 (13:41 -0700)
commit6829309926b90c4c32d1f4cafeb600cd34a721e3
tree3098cd027df9c533003000ccfdae9f570691e049
parent8a8e3d84b1719a56f9151909e80ea6ebc5b8e318
net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset

Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
condition is met and netdev is NULL. Then, the jump to the 'done' label
calls dev_close() with a netdevice that is NULL. Therefore, only call
dev_close() when we have a netdevice, but one that is not running.

[ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
Nayak Sujir ]

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
Cc: Michael Chan <mchan@broadcom.com>
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/broadcom/tg3.c