diff options
| author | Hannes Hering <hering2@de.ibm.com> | 2009-05-04 11:06:37 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-05-04 11:06:37 -0700 |
| commit | 0b2febf38a33d7c40fb7bb4a58c113a1fa33c412 (patch) | |
| tree | 95993c55500c30ff17e04f530728d00f40480364 /drivers/net/ehea | |
| parent | 379b026ecc20c4657d37e40ead789f7f28f1a1c1 (diff) | |
| download | linux-stable-0b2febf38a33d7c40fb7bb4a58c113a1fa33c412.tar.gz linux-stable-0b2febf38a33d7c40fb7bb4a58c113a1fa33c412.tar.bz2 linux-stable-0b2febf38a33d7c40fb7bb4a58c113a1fa33c412.zip | |
ehea: fix invalid pointer access
This patch fixes an invalid pointer access in case the receive queue
holds no pointer to the next skb when the queue is empty.
Signed-off-by: Hannes Hering <hering2@de.ibm.com>
Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ehea')
| -rw-r--r-- | drivers/net/ehea/ehea.h | 2 | ||||
| -rw-r--r-- | drivers/net/ehea/ehea_main.c | 31 |
2 files changed, 19 insertions, 14 deletions
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h index 6e317caf429c..16a41389575a 100644 --- a/drivers/net/ehea/ehea.h +++ b/drivers/net/ehea/ehea.h @@ -40,7 +40,7 @@ #include <asm/io.h> #define DRV_NAME "ehea" -#define DRV_VERSION "EHEA_0100" +#define DRV_VERSION "EHEA_0101" /* eHEA capability flags */ #define DLPAR_PORT_ADD_REM 1 diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c index 604c844d0769..b22dab9153f6 100644 --- a/drivers/net/ehea/ehea_main.c +++ b/drivers/net/ehea/ehea_main.c @@ -545,14 +545,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array, x &= (arr_len - 1); pref = skb_array[x]; - prefetchw(pref); - prefetchw(pref + EHEA_CACHE_LINE); - - pref = (skb_array[x]->data); - prefetch(pref); - prefetch(pref + EHEA_CACHE_LINE); - prefetch(pref + EHEA_CACHE_LINE * 2); - prefetch(pref + EHEA_CACHE_LINE * 3); + if (pref) { + prefetchw(pref); + prefetchw(pref + EHEA_CACHE_LINE); + + pref = (skb_array[x]->data); + prefetch(pref); + prefetch(pref + EHEA_CACHE_LINE); + prefetch(pref + EHEA_CACHE_LINE * 2); + prefetch(pref + EHEA_CACHE_LINE * 3); + } + skb = skb_array[skb_index]; skb_array[skb_index] = NULL; return skb; @@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array, x &= (arr_len - 1); pref = skb_array[x]; - prefetchw(pref); - prefetchw(pref + EHEA_CACHE_LINE); + if (pref) { + prefetchw(pref); + prefetchw(pref + EHEA_CACHE_LINE); - pref = (skb_array[x]->data); - prefetchw(pref); - prefetchw(pref + EHEA_CACHE_LINE); + pref = (skb_array[x]->data); + prefetchw(pref); + prefetchw(pref + EHEA_CACHE_LINE); + } skb = skb_array[wqe_index]; skb_array[wqe_index] = NULL; |