Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b2febf3 authored by Hannes Hering's avatar Hannes Hering Committed by David S. Miller
Browse files

ehea: fix invalid pointer access 



This patch fixes an invalid pointer access in case the receive queue
holds no pointer to the next skb when the queue is empty.

Signed-off-by: default avatarHannes Hering <hering2@de.ibm.com>
Signed-off-by: default avatarJan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 379b026e

drivers/net/ehea/ehea.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -40,7 +40,7 @@ 
#include <asm/io.h>

#include <asm/io.h>





#define DRV_NAME	"ehea"

#define DRV_NAME	"ehea"

#define DRV_VERSION	"EHEA_0100"

#define DRV_VERSION	"EHEA_0101"





/* eHEA capability flags */

/* eHEA capability flags */

#define DLPAR_PORT_ADD_REM 1

#define DLPAR_PORT_ADD_REM 1

drivers/net/ehea/ehea_main.c

+18 −13
Original line number Original line Diff line number Diff line
@@ -545,6 +545,7 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array, 
	x &= (arr_len - 1);

	x &= (arr_len - 1);





	pref = skb_array[x];

	pref = skb_array[x];

	if (pref) {

		prefetchw(pref);

		prefetchw(pref);

		prefetchw(pref + EHEA_CACHE_LINE);

		prefetchw(pref + EHEA_CACHE_LINE);
@@ -553,6 +554,8 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array, 
		prefetch(pref + EHEA_CACHE_LINE);

		prefetch(pref + EHEA_CACHE_LINE);

		prefetch(pref + EHEA_CACHE_LINE * 2);

		prefetch(pref + EHEA_CACHE_LINE * 2);

		prefetch(pref + EHEA_CACHE_LINE * 3);

		prefetch(pref + EHEA_CACHE_LINE * 3);

	}



	skb = skb_array[skb_index];

	skb = skb_array[skb_index];

	skb_array[skb_index] = NULL;

	skb_array[skb_index] = NULL;

	return skb;

	return skb;
@@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array, 
	x &= (arr_len - 1);

	x &= (arr_len - 1);





	pref = skb_array[x];

	pref = skb_array[x];

	if (pref) {

		prefetchw(pref);

		prefetchw(pref);

		prefetchw(pref + EHEA_CACHE_LINE);

		prefetchw(pref + EHEA_CACHE_LINE);





		pref = (skb_array[x]->data);

		pref = (skb_array[x]->data);

		prefetchw(pref);

		prefetchw(pref);

		prefetchw(pref + EHEA_CACHE_LINE);

		prefetchw(pref + EHEA_CACHE_LINE);

	}





	skb = skb_array[wqe_index];

	skb = skb_array[wqe_index];

	skb_array[wqe_index] = NULL;

	skb_array[wqe_index] = NULL;