diff options
| author | sam <sam@FreeBSD.org> | 2005-03-28 17:49:03 +0000 |
|---|---|---|
| committer | sam <sam@FreeBSD.org> | 2005-03-28 17:49:03 +0000 |
| commit | c933de3749a08df98af0021abbe903699dcddb28 (patch) | |
| tree | 5750e51d392c20461f9be24360943598b3203ccf /sys/dev/nge | |
| parent | 12c3eeb4fa1b4cb21122c3550ba30283203f40d0 (diff) | |
| download | FreeBSD-src-c933de3749a08df98af0021abbe903699dcddb28.zip FreeBSD-src-c933de3749a08df98af0021abbe903699dcddb28.tar.gz | |
fix null ptr deref when nge_newbuf is called with an existing mbuf
Noticed by: Coverity Prevent analysis tool
Diffstat (limited to 'sys/dev/nge')
| -rw-r--r-- | sys/dev/nge/if_nge.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/sys/dev/nge/if_nge.c b/sys/dev/nge/if_nge.c index d68be4b..0fc0fca 100644 --- a/sys/dev/nge/if_nge.c +++ b/sys/dev/nge/if_nge.c @@ -1053,23 +1053,21 @@ nge_newbuf(sc, c, m) struct nge_desc *c; struct mbuf *m; { - struct mbuf *m_new = NULL; if (m == NULL) { - m_new = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR); - if (m_new == NULL) + m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR); + if (m == NULL) return (ENOBUFS); - m = m_new; } else m->m_data = m->m_ext.ext_buf; m->m_len = m->m_pkthdr.len = MCLBYTES; - m_adj(m_new, sizeof(u_int64_t)); + m_adj(m, sizeof(u_int64_t)); - c->nge_mbuf = m_new; - c->nge_ptr = vtophys(mtod(m_new, caddr_t)); - c->nge_ctl = m_new->m_len; + c->nge_mbuf = m; + c->nge_ptr = vtophys(mtod(m, caddr_t)); + c->nge_ctl = m->m_len; c->nge_extsts = 0; return(0); |
