can: ctucanfd: handle skb allocation failure

If skb allocation fails, the pointer to struct can_frame is NULL. This
is actually handled everywhere inside ctucan_err_interrupt() except for
the only place.

Add the missed NULL check.

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.

Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://patch.msgid.link/20250114152138.139580-1-pchelkin@ispras.ru
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

diff --git a/drivers/net/can/ctucanfd/ctucanfd_base.c b/drivers/net/can/ctucanfd/ctucanfd_base.c
index 64c349fd46007fe915f3ce51b4931cf61734260b..f65c1a1e05ccdfb723fafa4d1d75e3c64ddc427a 100644 (file)
--- a/drivers/net/can/ctucanfd/ctucanfd_base.c
+++ b/drivers/net/can/ctucanfd/ctucanfd_base.c
@@ -867,10 +867,12 @@ static void ctucan_err_interrupt(struct net_device *ndev, u32 isr)
                        }
                        break;
                case CAN_STATE_ERROR_ACTIVE:
-                       cf->can_id |= CAN_ERR_CNT;
-                       cf->data[1] = CAN_ERR_CRTL_ACTIVE;
-                       cf->data[6] = bec.txerr;
-                       cf->data[7] = bec.rxerr;
+                       if (skb) {
+                               cf->can_id |= CAN_ERR_CNT;
+                               cf->data[1] = CAN_ERR_CRTL_ACTIVE;
+                               cf->data[6] = bec.txerr;
+                               cf->data[7] = bec.rxerr;
+                       }
                        break;
                default:
                        netdev_warn(ndev, "unhandled error state (%d:%s)!\n",