From 03cd7136d68b4877a9e1793d31cab38fdcb67434 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Sat, 8 Aug 2009 00:35:31 +0200 Subject: [PATCH] Staging: vt6655: fix possible Read buffer overflow If pDevice->sOpts.nRxDescs{0,1} or nTxDescs[{0,1}] is zero, the loop ends with i == 0, and we write aRD{0,1}Ring[-1]. apTD{0,1}Rings[-1] respectively. Signed-off-by: Roel Kluin Signed-off-by: Greg Kroah-Hartman --- drivers/staging/vt6655/device_main.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c index 449e47a839d9..53450b48eaa6 100644 --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1400,7 +1400,8 @@ static void device_init_rd0_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc)); } - pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma); + if (i > 0) + pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma); pDevice->pCurrRD[0] = &(pDevice->aRD0Ring[0]); } @@ -1424,7 +1425,8 @@ static void device_init_rd1_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc)); } - pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma); + if (i > 0) + pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma); pDevice->pCurrRD[1] = &(pDevice->aRD1Ring[0]); } @@ -1517,7 +1519,8 @@ static void device_init_td0_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc)); } - pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma); + if (i > 0) + pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma); pDevice->apTailTD[0] = pDevice->apCurrTD[0] =&(pDevice->apTD0Rings[0]); } @@ -1542,7 +1545,8 @@ static void device_init_td1_ring(PSDevice pDevice) { pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc)); } - pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma); + if (i > 0) + pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma); pDevice->apTailTD[1] = pDevice->apCurrTD[1] = &(pDevice->apTD1Rings[0]); } -- 2.34.1