From: roel kluin Date: Thu, 30 Jul 2009 00:26:32 +0000 (+0000) Subject: 3c515: Write outside array bounds X-Git-Tag: upstream/snapshot3+hdmi~17715^2~108 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3d54015b750e5d5e950a1dcee2735387fd4b6e1a;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git 3c515: Write outside array bounds if dev_alloc_skb() fails on the first iteration, a write to cp->rx_ring[-1] occurs. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller --- diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c index 3e00fa8..4a7c328 100644 --- a/drivers/net/3c515.c +++ b/drivers/net/3c515.c @@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev) skb_reserve(skb, 2); /* Align IP on 16 byte boundaries */ vp->rx_ring[i].addr = isa_virt_to_bus(skb->data); } - vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]); /* Wrap the ring. */ + if (i != 0) + vp->rx_ring[i - 1].next = + isa_virt_to_bus(&vp->rx_ring[0]); /* Wrap the ring. */ outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr); } if (vp->full_bus_master_tx) { /* Boomerang bus master Tx. */