If `np->rx_skbuff[entry]` was not allocated before reuse, `receive_packet()` will cause null dereference. This patch fixes the issue by breaking out of the loop when `np->rx_skbuff[entry]` is `NULL`. Found by inspection. Signed-off-by: Yeounsu Moon Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-on: D-Link DGE-550T Rev-A3 --- drivers/net/ethernet/dlink/dl2k.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c index 1996d2e4e3e2..aa3840454fcb 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -969,6 +969,8 @@ receive_packet (struct net_device *dev) if (pkt_len <= copy_thresh) skb = netdev_alloc_skb_ip_align(dev, pkt_len); if (!skb) { + if (!np->rx_skbuff[entry]) + break; dma_unmap_single(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, -- 2.51.0