From b1abfe6c7ca3c2da4b2b02f92230cef0dc500a8e Mon Sep 17 00:00:00 2001
From: Marius Strobl <marius@FreeBSD.org>
Date: Thu, 3 Jun 2010 12:09:02 +0000
Subject: [PATCH] Avoid possible NULL-dereferences.

Found with:	Coverity Prevent(tm)
CID:		3428
MFC after:	3 days
---
 sys/dev/cas/if_cas.c | 46 ++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 19 deletions(-)

diff --git a/sys/dev/cas/if_cas.c b/sys/dev/cas/if_cas.c
index 3522f7ca3b74..0840ef10d40d 100644
--- a/sys/dev/cas/if_cas.c
+++ b/sys/dev/cas/if_cas.c
@@ -1787,6 +1787,7 @@ cas_rint(struct cas_softc *sc)
 				}
 			}
 			idx2 = 0;
+			m2 = NULL;
 			rxds2 = NULL;
 			if ((word1 & CAS_RC1_SPLIT_PKT) != 0) {
 				KASSERT((word1 & CAS_RC1_RELEASE_NEXT) != 0,
@@ -1799,32 +1800,39 @@ cas_rint(struct cas_softc *sc)
 				    __func__, idx2);
 #endif
 				rxds2 = &sc->sc_rxdsoft[idx2];
-				MGET(m2, M_DONTWAIT, MT_DATA);
-				if (m2 != NULL) {
-					refcount_acquire(
-					    &rxds2->rxds_refcount);
-					m2->m_len = len - m->m_len;
-					bus_dmamap_sync(sc->sc_rdmatag,
-					    rxds2->rxds_dmamap,
-					    BUS_DMASYNC_POSTREAD);
+				if (m != NULL) {
+					MGET(m2, M_DONTWAIT, MT_DATA);
+					if (m2 != NULL) {
+						refcount_acquire(
+						    &rxds2->rxds_refcount);
+						m2->m_len = len - m->m_len;
+						bus_dmamap_sync(
+						    sc->sc_rdmatag,
+						    rxds2->rxds_dmamap,
+						    BUS_DMASYNC_POSTREAD);
 #if __FreeBSD_version < 800016
-					MEXTADD(m2, (caddr_t)rxds2->rxds_buf,
-					    m2->m_len, cas_free, rxds2,
-					    M_RDONLY, EXT_NET_DRV);
+						MEXTADD(m2,
+						    (caddr_t)rxds2->rxds_buf,
+						    m2->m_len, cas_free,
+						    rxds2, M_RDONLY,
+						    EXT_NET_DRV);
 #else
-					MEXTADD(m2, (caddr_t)rxds2->rxds_buf,
-					    m2->m_len, cas_free,
-					    sc, (void *)(uintptr_t)idx2,
-					    M_RDONLY, EXT_NET_DRV);
+						MEXTADD(m2,
+						    (caddr_t)rxds2->rxds_buf,
+						    m2->m_len, cas_free, sc,
+						    (void *)(uintptr_t)idx2,
+						    M_RDONLY, EXT_NET_DRV);
 #endif
-					if ((m2->m_flags & M_EXT) == 0) {
-						m_freem(m2);
-						m2 = NULL;
+						if ((m2->m_flags & M_EXT) ==
+						    0) {
+							m_freem(m2);
+							m2 = NULL;
+						}
 					}
 				}
 				if (m2 != NULL)
 					m->m_next = m2;
-				else {
+				else if (m != NULL) {
 					m_freem(m);
 					m = NULL;
 				}