From: Andrey Vatoropin be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states.  Add a check for that. Another way would be to pass a valid wrb_params from be_xmit(), but that seems to be redundant as the corresponding bit in wrb_params should have been already set there in advance with a call to be_xmit_workarounds(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 760c295e0e8d ("be2net: Support for OS2BMC."). Signed-off-by: Andrey Vatoropin --- drivers/net/ethernet/emulex/benet/be_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c index cb004fd16252..467cc49fe1d5 100644 --- a/drivers/net/ethernet/emulex/benet/be_main.c +++ b/drivers/net/ethernet/emulex/benet/be_main.c @@ -1063,7 +1063,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter, /* f/w workaround to set skip_hw_vlan = 1, informs the F/W to * skip VLAN insertion */ - BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); + if (wrb_params) + BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); } if (insert_vlan) { @@ -1081,7 +1082,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter, vlan_tag); if (unlikely(!skb)) return skb; - BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); + if (wrb_params) + BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); } return skb; -- 2.43.0