From: Bruce Allan <bruce.w.allan@intel.com>
Date: Wed, 24 Nov 2010 07:42:43 +0000 (+0000)
Subject: e1000e: prevent null ptr dereference in e1000_tx_queue()
X-Git-Tag: v2.6.38-rc1~476^2~216
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=36b973df713e1395b79896de667ad7dbb1925fa7;p=karo-tx-linux.git

e1000e: prevent null ptr dereference in e1000_tx_queue()

tx_desc can be dereferenced as a null pointer when count is passed in
as 0.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Tested-by: Emil Tantilov <emil.s.tantilov@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---

diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 393b76d27536..4bf843ac7ea3 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4629,7 +4629,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
 
 	i = tx_ring->next_to_use;
 
-	while (count--) {
+	do {
 		buffer_info = &tx_ring->buffer_info[i];
 		tx_desc = E1000_TX_DESC(*tx_ring, i);
 		tx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
@@ -4640,7 +4640,7 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
 		i++;
 		if (i == tx_ring->count)
 			i = 0;
-	}
+	} while (--count > 0);
 
 	tx_desc->lower.data |= cpu_to_le32(adapter->txd_cmd);