Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a5a259f authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'sh_eth-fixes' 



Sergei Shtylyov says:

====================
sh_eth: fix couple of bugs in sh_eth_ring_format()

   Here's a set of 2 patches against DaveM's 'net.git' repo fixing two bugs
in sh_eth_.ring_format()...

[1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
[2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f720d0ca d0ba9134

drivers/net/ethernet/renesas/sh_eth.c

+6 −4
Original line number Diff line number Diff line
@@ -1127,11 +1127,8 @@ static void sh_eth_ring_format(struct net_device *ndev) 
			break;

		sh_eth_set_receive_align(skb);



		/* RX descriptor */

		rxdesc = &mdp->rx_ring[i];

		/* The size of the buffer is a multiple of 32 bytes. */

		buf_len = ALIGN(mdp->rx_buf_sz, 32);

		rxdesc->len = cpu_to_le32(buf_len << 16);

		dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,

					  DMA_FROM_DEVICE);

		if (dma_mapping_error(&ndev->dev, dma_addr)) {
@@ -1139,6 +1136,10 @@ static void sh_eth_ring_format(struct net_device *ndev) 
			break;

		}

		mdp->rx_skbuff[i] = skb;



		/* RX descriptor */

		rxdesc = &mdp->rx_ring[i];

		rxdesc->len = cpu_to_le32(buf_len << 16);

		rxdesc->addr = cpu_to_le32(dma_addr);

		rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP);
@@ -1154,6 +1155,7 @@ static void sh_eth_ring_format(struct net_device *ndev) 
	mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);



	/* Mark the last entry as wrapping the ring. */

	if (rxdesc)

		rxdesc->status |= cpu_to_le32(RD_RDLE);



	memset(mdp->tx_ring, 0, tx_ringsize);