aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/mv643xx_eth.c
diff options
context:
space:
mode:
authorLennert Buytenhek <buytenh@wantstofly.org>2008-08-23 20:33:47 -0400
committerLennert Buytenhek <buytenh@marvell.com>2008-08-23 21:33:40 -0400
commit9e1f37724265725ad4c14fc2ef60a162dc13ac64 (patch)
tree08fe8a280e33dd1c993947d3ea93ddcb8062e3b2 /drivers/net/mv643xx_eth.c
parent8e0b1bf6ac6c4c6dd985e586cd765aede4678bba (diff)
mv643xx_eth: fix NULL pointer dereference in rxq_process()
When we are low on memory, the assumption that every descriptor in the receive ring will have an skbuff associated with it does not hold. rxq_process() was assuming that if the receive descriptor it is working on is not owned by the hardware, it can safely be processed and handed to the networking stack. But a descriptor in the receive ring not being owned by the hardware can also happen when we are low on memory and did not manage to refill the receive ring fully. This patch changes rxq_process()'s bailout condition from "the first receive descriptor to be processed is owned by the hardware" to "the first receive descriptor to be processed is owned by the hardware OR the number of valid receive descriptors in the ring is zero". Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Diffstat (limited to 'drivers/net/mv643xx_eth.c')
-rw-r--r--drivers/net/mv643xx_eth.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 30e6d4b8d564..e33dfc0165f6 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -527,7 +527,7 @@ static int rxq_process(struct rx_queue *rxq, int budget)
527 int rx; 527 int rx;
528 528
529 rx = 0; 529 rx = 0;
530 while (rx < budget) { 530 while (rx < budget && rxq->rx_desc_count) {
531 struct rx_desc *rx_desc; 531 struct rx_desc *rx_desc;
532 unsigned int cmd_sts; 532 unsigned int cmd_sts;
533 struct sk_buff *skb; 533 struct sk_buff *skb;