| commit | 66cfd1bd05a7a1c31c9cdbb2ddf5c57d1cddc5f6 | |
| author | Matt Carlson <mcarlson@broadcom.com> | |
| Thu, 30 Sep 2010 10:34:30 +0000 (30 10:34 +0000) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Fri, 1 Oct 2010 07:24:41 +0000 (1 00:24 -0700) | ||
| tree | db289b3d2e73bc3a9f6dcb480911210046c0de07 | treesnapshot (tar.gz zip) |
| parent | 0197aa38df2ce550c0bfc96194b07ce6b68af814 | commitdiff |
tg3: Fix potential netpoll crash
Up until now the tg3 driver would call netif_napi_add() for the maximum
number of NAPI instances the driver could use. The problem is that
netpoll could call tg3_poll() on instances that are not active. The net
effect is that the driver will crash attempting to dereference
uninitialized pointers.
The fix is to only allocate as many NAPI instances as the driver would
use in tg3_open() and deleted them in tg3_close().
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Up until now the tg3 driver would call netif_napi_add() for the maximum
number of NAPI instances the driver could use. The problem is that
netpoll could call tg3_poll() on instances that are not active. The net
effect is that the driver will crash attempting to dereference
uninitialized pointers.
The fix is to only allocate as many NAPI instances as the driver would
use in tg3_open() and deleted them in tg3_close().
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| drivers/net/tg3.c | diffblobblamehistory |