From 36b973df713e1395b79896de667ad7dbb1925fa7 Mon Sep 17 00:00:00 2001 From: Bruce Allan Date: Wed, 24 Nov 2010 07:42:43 +0000 Subject: [PATCH] e1000e: prevent null ptr dereference in e1000_tx_queue() tx_desc can be dereferenced as a null pointer when count is passed in as 0. Signed-off-by: Bruce Allan Tested-by: Emil Tantilov Signed-off-by: Jeff Kirsher --- drivers/net/e1000e/netdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c index 393b76d27536..4bf843ac7ea3 100644 --- a/drivers/net/e1000e/netdev.c +++ b/drivers/net/e1000e/netdev.c @@ -4629,7 +4629,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter, i = tx_ring->next_to_use; - while (count--) { + do { buffer_info = &tx_ring->buffer_info[i]; tx_desc = E1000_TX_DESC(*tx_ring, i); tx_desc->buffer_addr = cpu_to_le64(buffer_info->dma); @@ -4640,7 +4640,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter, i++; if (i == tx_ring->count) i = 0; - } + } while (--count > 0); tx_desc->lower.data |= cpu_to_le32(adapter->txd_cmd); -- 2.20.1