diff options
| author | Bruce Allan <bruce.w.allan@intel.com> | 2010-11-24 10:42:43 +0300 |
|---|---|---|
| committer | Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 2010-12-11 09:13:41 +0300 |
| commit | 36b973df713e1395b79896de667ad7dbb1925fa7 (patch) | |
| tree | 087d9cff2e4b786b9af7b62984294e05b0428e41 /drivers/net/e1000e/netdev.c | |
| parent | 073287c037083497ebaaf75ead469b769f218615 (diff) | |
| download | linux-36b973df713e1395b79896de667ad7dbb1925fa7.tar.xz | |
e1000e: prevent null ptr dereference in e1000_tx_queue()
tx_desc can be dereferenced as a null pointer when count is passed in
as 0.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Tested-by: Emil Tantilov <emil.s.tantilov@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Diffstat (limited to 'drivers/net/e1000e/netdev.c')
| -rw-r--r-- | drivers/net/e1000e/netdev.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c index 393b76d27536..4bf843ac7ea3 100644 --- a/drivers/net/e1000e/netdev.c +++ b/drivers/net/e1000e/netdev.c @@ -4629,7 +4629,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter, i = tx_ring->next_to_use; - while (count--) { + do { buffer_info = &tx_ring->buffer_info[i]; tx_desc = E1000_TX_DESC(*tx_ring, i); tx_desc->buffer_addr = cpu_to_le64(buffer_info->dma); @@ -4640,7 +4640,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter, i++; if (i == tx_ring->count) i = 0; - } + } while (--count > 0); tx_desc->lower.data |= cpu_to_le32(adapter->txd_cmd); |