diff options
| author | Juha Leppanen <juha_motorsportcom@luukku.com> | 2009-09-28 23:45:29 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-09-28 23:45:29 +0400 |
| commit | 1b66c1ef2fd86082d49b1e005bd86fd0c60ad552 (patch) | |
| tree | 4245fdd3afdc4c9cc64678efbf4f9741d2c6ff8e /drivers/atm/he.c | |
| parent | 2f72291d3d0e440f9343c7b97dc233c1a122165a (diff) | |
| download | linux-1b66c1ef2fd86082d49b1e005bd86fd0c60ad552.tar.xz | |
atm: dereference of he_dev->rbps_virt in he_init_group()
The prefix decrement causes a very long loop if pci_pool_alloc() failed
in the first iteration. Also I swapped rbps and rbpl arguments.
Reported-by: Juha Leppanen <juha_motorsportcom@luukku.com>
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/atm/he.c')
| -rw-r--r-- | drivers/atm/he.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/atm/he.c b/drivers/atm/he.c index 29e66d603d3c..70667033a568 100644 --- a/drivers/atm/he.c +++ b/drivers/atm/he.c @@ -921,9 +921,9 @@ out_free_rbpq_base: he_dev->rbrq_phys); i = CONFIG_RBPL_SIZE; out_free_rbpl_virt: - while (--i) - pci_pool_free(he_dev->rbps_pool, he_dev->rbpl_virt[i].virt, - he_dev->rbps_base[i].phys); + while (i--) + pci_pool_free(he_dev->rbpl_pool, he_dev->rbpl_virt[i].virt, + he_dev->rbpl_base[i].phys); kfree(he_dev->rbpl_virt); out_free_rbpl_base: @@ -933,11 +933,11 @@ out_free_rbpl_base: out_destroy_rbpl_pool: pci_pool_destroy(he_dev->rbpl_pool); - i = CONFIG_RBPL_SIZE; + i = CONFIG_RBPS_SIZE; out_free_rbps_virt: - while (--i) - pci_pool_free(he_dev->rbpl_pool, he_dev->rbps_virt[i].virt, - he_dev->rbpl_base[i].phys); + while (i--) + pci_pool_free(he_dev->rbps_pool, he_dev->rbps_virt[i].virt, + he_dev->rbps_base[i].phys); kfree(he_dev->rbps_virt); out_free_rbps_base: |