mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-29 04:09:39 +00:00
Code Issues Releases Wiki Activity

mv643xx_eth: fix NULL pointer dereference in rxq_process()

Browse source 
When we are low on memory, the assumption that every descriptor in the
receive ring will have an skbuff associated with it does not hold.

rxq_process() was assuming that if the receive descriptor it is working
on is not owned by the hardware, it can safely be processed and handed
to the networking stack.  But a descriptor in the receive ring not being
owned by the hardware can also happen when we are low on memory and did
not manage to refill the receive ring fully.

This patch changes rxq_process()'s bailout condition from "the first
receive descriptor to be processed is owned by the hardware" to "the
first receive descriptor to be processed is owned by the hardware OR
the number of valid receive descriptors in the ring is zero".

Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
This commit is contained in:
Lennert Buytenhek 2008-08-24 02:33:47 +02:00 committed by Lennert Buytenhek
parent 8e0b1bf6ac
commit 9e1f377242
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/net/mv643xx_eth.c
View file

@ -527,7 +527,7 @@ static int rxq_process(struct rx_queue *rxq, int budget)
int rx;
rx = 0;
while (rx < budget) {
while (rx < budget && rxq->rx_desc_count) {
struct rx_desc *rx_desc;
unsigned int cmd_sts;
struct sk_buff *skb;