Commit 36b973df authored by Bruce Allan's avatar Bruce Allan Committed by Jeff Kirsher

e1000e: prevent null ptr dereference in e1000_tx_queue()

tx_desc can be dereferenced as a null pointer when count is passed in
as 0.
Signed-off-by: default avatarBruce Allan <bruce.w.allan@intel.com>
Tested-by: default avatarEmil Tantilov <emil.s.tantilov@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 073287c0
...@@ -4629,7 +4629,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter, ...@@ -4629,7 +4629,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
i = tx_ring->next_to_use; i = tx_ring->next_to_use;
while (count--) { do {
buffer_info = &tx_ring->buffer_info[i]; buffer_info = &tx_ring->buffer_info[i];
tx_desc = E1000_TX_DESC(*tx_ring, i); tx_desc = E1000_TX_DESC(*tx_ring, i);
tx_desc->buffer_addr = cpu_to_le64(buffer_info->dma); tx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
...@@ -4640,7 +4640,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter, ...@@ -4640,7 +4640,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
i++; i++;
if (i == tx_ring->count) if (i == tx_ring->count)
i = 0; i = 0;
} } while (--count > 0);
tx_desc->lower.data |= cpu_to_le32(adapter->txd_cmd); tx_desc->lower.data |= cpu_to_le32(adapter->txd_cmd);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment