a minor bug in via-rhine driver for linux

a minor bug in via-rhine driver for linux

[pin xue]

Hi:

kernel source version : 2.6.14

file : drivers/net/via-rhine.c

function : alloc_tbufs(), line 1021~1039

problem line : 1035
        rp->tx_buf[i] = &rp->tx_bufs[i * PKT_BUF_SZ];

fix: line 1035 should be
        if ( rp->quirks & rqRhineI )
            rp->tx_buf[i] = &rp->tx_bufs[i * PKT_BUF_SZ];

explaination:
line 718 : here we set rqRhineI flag only for old chips
line 922 : here we allocate buffers and alloc rp->tx_bufs only when
rqRhineI flag setted.
line 1035: here we initialize buffers, but set rp->tx_buf[] based on
tx_bufs anyway.
line 1273: here we use the buffers and refer rp->tx_buf[] only when
rqRhineI flag setted.
Currently, line 1035 does not cause any invalid memory accessing but
calculating and saving some invalid memory address.

comments:
I'm reading this driver and line 1035 confused me for a moment.



--
Best Regards!

Yang Wu

Mobile Phone: +86-013636674084
WorldWideWeb:  http://www.pinxue.net

--
Best Regards!

Yang Wu

Mobile Phone: +86-013636674084
WorldWideWeb: http://www.pinxue.net

[PATCH] via-rhine: execute bounce buffers code on Rhine-I only

[Roger Luethi]

Patch suggested by Yang Wu (pin xue <pinxue@gmail.com>).

Signed-off-by: Roger Luethi <rl@hellgate.ch>

--- linux-2.6.16/drivers/net/via-rhine.c.orig	2006-04-04 13:52:29.000000000 +0200
+++ linux-2.6.16/drivers/net/via-rhine.c	2006-04-04 20:40:08.000000000 +0200
@@ -475,7 +475,7 @@ struct rhine_private {
 	struct sk_buff *tx_skbuff[TX_RING_SIZE];
 	dma_addr_t tx_skbuff_dma[TX_RING_SIZE];
 
-	/* Tx bounce buffers */
+	/* Tx bounce buffers (Rhine-I only) */
 	unsigned char *tx_buf[TX_RING_SIZE];
 	unsigned char *tx_bufs;
 	dma_addr_t tx_bufs_dma;
@@ -1052,7 +1052,8 @@ static void alloc_tbufs(struct net_devic
 		rp->tx_ring[i].desc_length = cpu_to_le32(TXDESC);
 		next += sizeof(struct tx_desc);
 		rp->tx_ring[i].next_desc = cpu_to_le32(next);
-		rp->tx_buf[i] = &rp->tx_bufs[i * PKT_BUF_SZ];
+		if (rp->quirks & rqRhineI)
+			rp->tx_buf[i] = &rp->tx_bufs[i * PKT_BUF_SZ];
 	}
 	rp->tx_ring[i-1].next_desc = cpu_to_le32(rp->tx_ring_dma);