ehea: fix invalid pointer access

commit 0b2febf38a33d7c40fb7bb4a58c113a1fa33c412 upstream.

This patch fixes an invalid pointer access in case the receive queue
holds no pointer to the next skb when the queue is empty.

Signed-off-by: Hannes Hering <hering2@de.ibm.com>
Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index dfe92264e8252978d5719dc81f5b08dfff6d5f25..9a594142b4581da0b0468b3fb4682ba566665809 100644 (file)
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -529,14 +529,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
        x &= (arr_len - 1);
 
        pref = skb_array[x];
-       prefetchw(pref);
-       prefetchw(pref + EHEA_CACHE_LINE);
-
-       pref = (skb_array[x]->data);
-       prefetch(pref);
-       prefetch(pref + EHEA_CACHE_LINE);
-       prefetch(pref + EHEA_CACHE_LINE * 2);
-       prefetch(pref + EHEA_CACHE_LINE * 3);
+       if (pref) {
+               prefetchw(pref);
+               prefetchw(pref + EHEA_CACHE_LINE);
+
+               pref = (skb_array[x]->data);
+               prefetch(pref);
+               prefetch(pref + EHEA_CACHE_LINE);
+               prefetch(pref + EHEA_CACHE_LINE * 2);
+               prefetch(pref + EHEA_CACHE_LINE * 3);
+       }
+
        skb = skb_array[skb_index];
        skb_array[skb_index] = NULL;
        return skb;
@@ -553,12 +556,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
        x &= (arr_len - 1);
 
        pref = skb_array[x];
-       prefetchw(pref);
-       prefetchw(pref + EHEA_CACHE_LINE);
+       if (pref) {
+               prefetchw(pref);
+               prefetchw(pref + EHEA_CACHE_LINE);
 
-       pref = (skb_array[x]->data);
-       prefetchw(pref);
-       prefetchw(pref + EHEA_CACHE_LINE);
+               pref = (skb_array[x]->data);
+               prefetchw(pref);
+               prefetchw(pref + EHEA_CACHE_LINE);
+       }
 
        skb = skb_array[wqe_index];
        skb_array[wqe_index] = NULL;