diff options
| author |   Bjørn Mork <bjorn@mork.no> | 2014-01-10 23:10:17 +0100 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2014-01-13 23:32:04 -0800 |
| commit | fdc3452cd2c7b2bfe0f378f92123f4f9a98fa2bd (patch) | |
| tree | d40ea95047fff32b0f3dd3d0e094d58cf49a428e | |
| parent | inet_diag: fix inet_diag_dump_icsk() to use correct state for timewait sockets (diff) | |
| download | linux-dev-fdc3452cd2c7b2bfe0f378f92123f4f9a98fa2bd.tar.xz linux-dev-fdc3452cd2c7b2bfe0f378f92123f4f9a98fa2bd.zip | |
net: usbnet: fix SG initialisation
Commit 60e453a940ac ("USBNET: fix handling padding packet")
added an extra SG entry in case padding is necessary, but
failed to update the initialisation of the list. This can
cause list traversal to fall off the end of the list,
resulting in an oops.
Fixes: 60e453a940ac ("USBNET: fix handling padding packet")
Reported-by: Thomas Kear <thomas@kear.co.nz>
Cc: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Tested-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/usb/usbnet.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 8494bb53ebdc..aba04f561760 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb) return -ENOMEM; urb->num_sgs = num_sgs; - sg_init_table(urb->sg, urb->num_sgs); + sg_init_table(urb->sg, urb->num_sgs + 1); sg_set_buf(&urb->sg[s++], skb->data, skb_headlen(skb)); total_len += skb_headlen(skb); |