Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Staging: vt6655: fix possible Read buffer overflow

Browse source 
If pDevice->sOpts.nRxDescs{0,1} or nTxDescs[{0,1}] is zero, the loop ends with
i == 0, and we write aRD{0,1}Ring[-1]. apTD{0,1}Rings[-1] respectively.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Roel Kluin 2009-08-08 00:35:31 +02:00 • committed by Greg Kroah-Hartman
parent 256a816b6b
commit 03cd7136d6
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/staging/vt6655/device_main.c
View file

@ -1400,7 +1400,8 @@ static void device_init_rd0_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc));
}
pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma);
if (i > 0)
pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma);
pDevice->pCurrRD[0] = &(pDevice->aRD0Ring[0]);
}
@ -1424,7 +1425,8 @@ static void device_init_rd1_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc));
}
pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma);
if (i > 0)
pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma);
pDevice->pCurrRD[1] = &(pDevice->aRD1Ring[0]);
}
@ -1517,7 +1519,8 @@ static void device_init_td0_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc));
}
pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma);
if (i > 0)
pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma);
pDevice->apTailTD[0] = pDevice->apCurrTD[0] =&(pDevice->apTD0Rings[0]);
}
@ -1542,7 +1545,8 @@ static void device_init_td1_ring(PSDevice pDevice) {
pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc));
}
pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma);
if (i > 0)
pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma);
pDevice->apTailTD[1] = pDevice->apCurrTD[1] = &(pDevice->apTD1Rings[0]);
}