[PATCH] 2.5.55 fix etherleak in 8390.c [rescued]

[PATCH] 2.5.55 fix etherleak in 8390.c [rescued]

[Rudmer van Dijk]

this is the fix which went in 2.4.21-pre3-ac2, rediffed against 2.5.55

	Rudmer

--- linux-2.5.55/drivers/net/8390.c.orig	2003-01-10 16:23:44.000000000 +0100
+++ linux-2.5.55/drivers/net/8390.c	2003-01-10 16:23:00.000000000 +0100
@@ -270,6 +270,7 @@
 	struct ei_device *ei_local = (struct ei_device *) dev->priv;
 	int length, send_length, output_page;
 	unsigned long flags;
+	char scratch[ETH_ZLEN];
 
 	length = skb->len;
 
@@ -341,7 +342,15 @@
 	 * trigger the send later, upon receiving a Tx done interrupt.
 	 */
 
-	ei_block_output(dev, length, skb->data, output_page);
+	if (length == send_length)
+		ei_block_output(dev, length, skb->data, output_page);
+	else
+	{
+		memset(scratch, 0, ETH_ZLEN);
+		memcpy(scratch, skb->data, skb->len);
+		ei_block_output(dev, ETH_ZLEN, scratch, output_page);
+	}
+
 	if (! ei_local->txing) 
 	{
 		ei_local->txing = 1;
@@ -373,7 +382,14 @@
 	 * reasonable hardware if you only use one Tx buffer.
 	 */
 
-	ei_block_output(dev, length, skb->data, ei_local->tx_start_page);
+	if(length == send_length)
+		ei_block_output(dev, length, skb->data, ei_local->tx_start_page);
+	else
+	{
+		memset(scratch, 0, ETH_ZLEN);
+		memcpy(scratch, skb->data, skb->len);
+		ei_block_output(dev, ETH_ZLEN, scratch, ei_local->tx_start_page);
+	}
 	ei_local->txing = 1;
 	NS8390_trigger_send(dev, send_length, ei_local->tx_start_page);
 	dev->trans_start = jiffies;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] 2.5.55 fix etherleak in 8390.c [rescued]

[Matti Aarnio]

On Fri, Jan 10, 2003 at 07:35:10PM +0100, Rudmer van Dijk wrote:
> this is the fix which went in 2.4.21-pre3-ac2, rediffed against 2.5.55
> 	Rudmer

  That  scratch[]  allocation is 60 bytes, taken off the stack.
  It isn't very large, and isn't recursive, but still...

> --- linux-2.5.55/drivers/net/8390.c.orig	2003-01-10 16:23:44.000000000 +0100
> +++ linux-2.5.55/drivers/net/8390.c	2003-01-10 16:23:00.000000000 +0100
> @@ -270,6 +270,7 @@
>  	struct ei_device *ei_local = (struct ei_device *) dev->priv;
>  	int length, send_length, output_page;
>  	unsigned long flags;
> +	char scratch[ETH_ZLEN];
>  
>  	length = skb->len;


/Matti Aarnio