From: Juha Leppanen Date: Mon, 28 Sep 2009 19:45:29 +0000 (-0700) Subject: atm: dereference of he_dev->rbps_virt in he_init_group() X-Git-Tag: v2.6.32-rc3~12^2~52 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=1b66c1ef2fd86082d49b1e005bd86fd0c60ad552;p=platform%2Fkernel%2Flinux-3.10.git atm: dereference of he_dev->rbps_virt in he_init_group() The prefix decrement causes a very long loop if pci_pool_alloc() failed in the first iteration. Also I swapped rbps and rbpl arguments. Reported-by: Juha Leppanen Signed-off-by: Roel Kluin Signed-off-by: David S. Miller --- diff --git a/drivers/atm/he.c b/drivers/atm/he.c index 29e66d6..7066703 100644 --- a/drivers/atm/he.c +++ b/drivers/atm/he.c @@ -921,9 +921,9 @@ out_free_rbpq_base: he_dev->rbrq_phys); i = CONFIG_RBPL_SIZE; out_free_rbpl_virt: - while (--i) - pci_pool_free(he_dev->rbps_pool, he_dev->rbpl_virt[i].virt, - he_dev->rbps_base[i].phys); + while (i--) + pci_pool_free(he_dev->rbpl_pool, he_dev->rbpl_virt[i].virt, + he_dev->rbpl_base[i].phys); kfree(he_dev->rbpl_virt); out_free_rbpl_base: @@ -933,11 +933,11 @@ out_free_rbpl_base: out_destroy_rbpl_pool: pci_pool_destroy(he_dev->rbpl_pool); - i = CONFIG_RBPL_SIZE; + i = CONFIG_RBPS_SIZE; out_free_rbps_virt: - while (--i) - pci_pool_free(he_dev->rbpl_pool, he_dev->rbps_virt[i].virt, - he_dev->rbpl_base[i].phys); + while (i--) + pci_pool_free(he_dev->rbps_pool, he_dev->rbps_virt[i].virt, + he_dev->rbps_base[i].phys); kfree(he_dev->rbps_virt); out_free_rbps_base: