On Sun, 2013-07-28 at 14:53 -0400, Neil Horman wrote:

 
I agree, I think perhaps a loop higher up prior to the rrs_checked label to
ensure that rfd_num is at least 1 prior to going through the rest of the rx
path.  I'll have something for the reporters to test tomorrow.

btw, this driver leaks skb horribly in this error path :

                if (rrs->word3 & (RRS_RX_ERR_SUM | RRS_802_3_LEN_ERR)) {
                        atl1c_clean_rfd(rfd_ring, rrs, rfd_num);
                                if (netif_msg_rx_err(adapter))
                                        dev_warn(&pdev->dev,
                                                "wrong packet! rrs word3 is %x\n",
                                                rrs->word3);
                        continue;
                }