On Mon, Jun 22, 2026 at 11:27:41AM +0530, Pavan Chebbi wrote:

On Mon, Jun 22, 2026 at 10:20 AM Haoxiang Li [off-list ref] wrote:

quoted

meth_init_rx_ring() does not check the return value of alloc_skb().
If the allocation fails, the NULL skb is passed to skb_reserve() and
then dereferenced through skb->head.

Add check for alloc_skb() to prevent potential null pointer dereference.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <redacted>
---
 drivers/net/ethernet/sgi/meth.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/sgi/meth.c b/drivers/net/ethernet/sgi/meth.c
index f7c3a5a766b7..ceff3cc937ad 100644
--- a/drivers/net/ethernet/sgi/meth.c
+++ b/drivers/net/ethernet/sgi/meth.c

@@ -228,6 +228,9 @@ static int meth_init_rx_ring(struct meth_private *priv)

        for (i = 0; i < RX_RING_ENTRIES; i++) {
                priv->rx_skbs[i] = alloc_skb(METH_RX_BUFF_SIZE, 0);
+               if (!priv->rx_skbs[i])
+                       return -ENOMEM;
+

I think the fix is not complete. The caller meth_open() will not free
any successfully allocated skbs if the function ever returns -ENOMEM.

There is also the question, does anybody care? Are SGI machines still
used? This is a Fast Ethernet driver, written in 2003. It has no
Maintainer. Maybe it would be better to just remove the driver?

At least drop the Fixes: tag, it does not fit the Stable rules.

https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

    Andrew

---
pw-bot: cr