diff options
author | Al Viro <viro@zeniv.linux.org.uk> | 2005-09-02 15:18:03 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2005-09-02 15:18:03 -0400 |
commit | d70063c4634af060a5387337b7632f6334ca3458 (patch) | |
tree | da02edf31bd8ae1f4ff5fa62ca664166d4d4a4d8 | |
parent | 6475be16fd9b3c6746ca4d18959246b13c669ea8 (diff) |
[ATM]: Fix dereference of uninitialized pointer in zatm
Fixing breakage from [NET]: Kill skb->list - original was
assign vcc
do a bunch of stuff using ZATM_VCC(vcc)->pool as common subexpression
Now we do
int pos = ZATM_VCC(vcc)->pool;
assign vcc
do a bunch of stuff
even though vcc is not even initialized when we enter that block...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | drivers/atm/zatm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c index c4b75ecf9460..55959e4d1cb7 100644 --- a/drivers/atm/zatm.c +++ b/drivers/atm/zatm.c | |||
@@ -417,9 +417,9 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]); | |||
417 | chan = (here[3] & uPD98401_AAL5_CHAN) >> | 417 | chan = (here[3] & uPD98401_AAL5_CHAN) >> |
418 | uPD98401_AAL5_CHAN_SHIFT; | 418 | uPD98401_AAL5_CHAN_SHIFT; |
419 | if (chan < zatm_dev->chans && zatm_dev->rx_map[chan]) { | 419 | if (chan < zatm_dev->chans && zatm_dev->rx_map[chan]) { |
420 | int pos = ZATM_VCC(vcc)->pool; | 420 | int pos; |
421 | |||
422 | vcc = zatm_dev->rx_map[chan]; | 421 | vcc = zatm_dev->rx_map[chan]; |
422 | pos = ZATM_VCC(vcc)->pool; | ||
423 | if (skb == zatm_dev->last_free[pos]) | 423 | if (skb == zatm_dev->last_free[pos]) |
424 | zatm_dev->last_free[pos] = NULL; | 424 | zatm_dev->last_free[pos] = NULL; |
425 | skb_unlink(skb, zatm_dev->pool + pos); | 425 | skb_unlink(skb, zatm_dev->pool + pos); |