From roel.kluin@gmail.com Mon Aug 17 13:07:33 2009 From: Roel Kluin Date: Sat, 08 Aug 2009 00:35:31 +0200 Subject: Staging: vt6655: fix possible Read buffer overflow To: Greg Kroah-Hartman , forest@alittletooquiet.net, devel@driverdev.osuosl.org, Andrew Morton Message-ID: <4A7CAC33.9020801@gmail.com> If pDevice->sOpts.nRxDescs{0,1} or nTxDescs[{0,1}] is zero, the loop ends with i == 0, and we write aRD{0,1}Ring[-1]. apTD{0,1}Rings[-1] respectively. Signed-off-by: Roel Kluin Signed-off-by: Greg Kroah-Hartman --- drivers/staging/vt6655/device_main.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1400,7 +1400,8 @@ static void device_init_rd0_ring(PSDevic pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc)); } - pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma); + if (i > 0) + pDevice->aRD0Ring[i-1].next_desc = cpu_to_le32(pDevice->rd0_pool_dma); pDevice->pCurrRD[0] = &(pDevice->aRD0Ring[0]); } @@ -1424,7 +1425,8 @@ static void device_init_rd1_ring(PSDevic pDesc->next_desc = cpu_to_le32(curr + sizeof(SRxDesc)); } - pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma); + if (i > 0) + pDevice->aRD1Ring[i-1].next_desc = cpu_to_le32(pDevice->rd1_pool_dma); pDevice->pCurrRD[1] = &(pDevice->aRD1Ring[0]); } @@ -1517,7 +1519,8 @@ static void device_init_td0_ring(PSDevic pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc)); } - pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma); + if (i > 0) + pDevice->apTD0Rings[i-1].next_desc = cpu_to_le32(pDevice->td0_pool_dma); pDevice->apTailTD[0] = pDevice->apCurrTD[0] =&(pDevice->apTD0Rings[0]); } @@ -1542,7 +1545,8 @@ static void device_init_td1_ring(PSDevic pDesc->next_desc = cpu_to_le32(curr+sizeof(STxDesc)); } - pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma); + if (i > 0) + pDevice->apTD1Rings[i-1].next_desc = cpu_to_le32(pDevice->td1_pool_dma); pDevice->apTailTD[1] = pDevice->apCurrTD[1] = &(pDevice->apTD1Rings[0]); }