diff options
| author | David S. Miller <davem@davemloft.net> | 2016-03-10 16:06:49 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-03-10 16:06:49 -0500 |
| commit | 2a5a259f9757250dc786e2091759155a868179ae (patch) | |
| tree | fcd16efd2a857d1a8ceb31f9fe92a8f9bc1ecb22 | |
| parent | f720d0caa0af2c33ad15310974c7320345ab4468 (diff) | |
| parent | d0ba913488dc8c55d1880f5ed34f096dc45fb05d (diff) | |
| download | linux-2a5a259f9757250dc786e2091759155a868179ae.tar.bz2 | |
Merge branch 'sh_eth-fixes'
Sergei Shtylyov says:
====================
sh_eth: fix couple of bugs in sh_eth_ring_format()
Here's a set of 2 patches against DaveM's 'net.git' repo fixing two bugs
in sh_eth_.ring_format()...
[1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
[2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/renesas/sh_eth.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c index 9c6448915b65..2e9a78164054 100644 --- a/drivers/net/ethernet/renesas/sh_eth.c +++ b/drivers/net/ethernet/renesas/sh_eth.c @@ -1127,11 +1127,8 @@ static void sh_eth_ring_format(struct net_device *ndev) break; sh_eth_set_receive_align(skb); - /* RX descriptor */ - rxdesc = &mdp->rx_ring[i]; /* The size of the buffer is a multiple of 32 bytes. */ buf_len = ALIGN(mdp->rx_buf_sz, 32); - rxdesc->len = cpu_to_le32(buf_len << 16); dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len, DMA_FROM_DEVICE); if (dma_mapping_error(&ndev->dev, dma_addr)) { @@ -1139,6 +1136,10 @@ static void sh_eth_ring_format(struct net_device *ndev) break; } mdp->rx_skbuff[i] = skb; + + /* RX descriptor */ + rxdesc = &mdp->rx_ring[i]; + rxdesc->len = cpu_to_le32(buf_len << 16); rxdesc->addr = cpu_to_le32(dma_addr); rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP); @@ -1154,7 +1155,8 @@ static void sh_eth_ring_format(struct net_device *ndev) mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); /* Mark the last entry as wrapping the ring. */ - rxdesc->status |= cpu_to_le32(RD_RDLE); + if (rxdesc) + rxdesc->status |= cpu_to_le32(RD_RDLE); memset(mdp->tx_ring, 0, tx_ringsize); |