diff options
| author | roel kluin <roel.kluin@gmail.com> | 2009-07-30 00:26:32 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-07-30 13:27:28 -0700 |
| commit | 3d54015b750e5d5e950a1dcee2735387fd4b6e1a (patch) | |
| tree | 3973a0cf147b4069bf3b33609e191cd9c70a1d1d /drivers/net/3c515.c | |
| parent | 2a8aaacda5097fa92a39948da1b4c6614b6e150e (diff) | |
3c515: Write outside array bounds
if dev_alloc_skb() fails on the first iteration, a write to
cp->rx_ring[-1] occurs.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/3c515.c')
| -rw-r--r-- | drivers/net/3c515.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c index 3e00fa8ea65f..4a7c32895be5 100644 --- a/drivers/net/3c515.c +++ b/drivers/net/3c515.c @@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev) skb_reserve(skb, 2); /* Align IP on 16 byte boundaries */ vp->rx_ring[i].addr = isa_virt_to_bus(skb->data); } - vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]); /* Wrap the ring. */ + if (i != 0) + vp->rx_ring[i - 1].next = + isa_virt_to_bus(&vp->rx_ring[0]); /* Wrap the ring. */ outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr); } if (vp->full_bus_master_tx) { /* Boomerang bus master Tx. */ |