aboutsummaryrefslogtreecommitdiff
path: root/drivers/staging/vt6655
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-08-08 00:35:31 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2009-09-15 12:02:09 -0700
commit03cd7136d68b4877a9e1793d31cab38fdcb67434 (patch)
treedb3e47648bd9ef6492d47e0630ccc639827905b2 /drivers/staging/vt6655
parent256a816b6b78bf29fba0c0f1bbcf998953429422 (diff)
Staging: vt6655: fix possible Read buffer overflow
If pDevice->sOpts.nRxDescs{0,1} or nTxDescs[{0,1}] is zero, the loop ends with i == 0, and we write aRD{0,1}Ring[-1]. apTD{0,1}Rings[-1] respectively. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/vt6655')
-rw-r--r--drivers/staging/vt6655/device_main.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 449e47a839d..53450b48eaa 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1400,7 +1400,8 @@ static void device_init_rd0_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc));
}
- pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma);
+ if (i > 0)
+ pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma);
pDevice->pCurrRD[0] = &(pDevice->aRD0Ring[0]);
}
@@ -1424,7 +1425,8 @@ static void device_init_rd1_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc));
}
- pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma);
+ if (i > 0)
+ pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma);
pDevice->pCurrRD[1] = &(pDevice->aRD1Ring[0]);
}
@@ -1517,7 +1519,8 @@ static void device_init_td0_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc));
}
- pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma);
+ if (i > 0)
+ pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma);
pDevice->apTailTD[0] = pDevice->apCurrTD[0] =&(pDevice->apTD0Rings[0]);
}
@@ -1542,7 +1545,8 @@ static void device_init_td1_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc));
}
- pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma);
+ if (i > 0)
+ pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma);
pDevice->apTailTD[1] = pDevice->apCurrTD[1] = &(pDevice->apTD1Rings[0]);
}