* [PATCH] mlx4_en: Fix read buffer overflow in mlx4_en_complete_rx_desc()
@ 2009-08-09 9:54 Roel Kluin
0 siblings, 0 replies; only message in thread
From: Roel Kluin @ 2009-08-09 9:54 UTC (permalink / raw)
To: netdev, Andrew Morton, yevgenyp, davem
If the length is less or equal to frag_prefix_size in the first iteration
we write skb_frags_rx[-1] and read from priv->frag_info[-1]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 91bdfdf..3ac0404 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -506,8 +506,9 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
PCI_DMA_FROMDEVICE);
}
/* Adjust size of last fragment to match actual length */
- skb_frags_rx[nr - 1].size = length -
- priv->frag_info[nr - 1].frag_prefix_size;
+ if (nr > 0)
+ skb_frags_rx[nr - 1].size = length -
+ priv->frag_info[nr - 1].frag_prefix_size;
return nr;
fail:
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2009-08-09 9:50 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-08-09 9:54 [PATCH] mlx4_en: Fix read buffer overflow in mlx4_en_complete_rx_desc() Roel Kluin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).