Subject: igmp: possible NULL dereference after GFP_ATOMIC allocation?

From: Alexey Dobriyan <[email-masked]>
Date: Tue, 30 Jan 2007 13:57:01 +0300

igmpv3_newpack() uses alloc_skb() with GFP_ATOMIC.
It fails, igmpv3_newpack() returns NULL.
add_grhead(), sees NULL,  returns NULL.

At one place add_grhead() return value fed into skb_put() which
dereferences it.

net/ipv4/igmp.c:
   454			if (first) {
   455				skb = add_grhead(skb, pmc, type, &pgr);
   456				first = 0;
   457			}
   458			psrc = (u32 *)skb_put(skb, sizeof(u32));