Re: [PATCH] p54spi: compensate firmware alignment bug in p54spi_rx

[Christian Lamparter <chunkeey@web.de>]

On Friday 27 March 2009 05:50:53 Max Filippov wrote:
> Firmware may insert up to 4 padding bytes after the lmac header,
> but it does not amend the size of SPI data transfer.
> Such packets has correct data size in header, thus referencing
> past the end of allocated skb. Put extra 4 bytes to the end of the
> received skb to compensate for this case.
> 
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Acked-by: Christian Lamparter <chunkeey@web.de>

> ---
>  drivers/net/wireless/p54/p54spi.c |   10 +++++++++-
>  1 files changed, 9 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
> index 5e8011c..35ea0dd 100644
> --- a/drivers/net/wireless/p54/p54spi.c
> +++ b/drivers/net/wireless/p54/p54spi.c
> @@ -381,7 +381,12 @@ static int p54spi_rx(struct p54s_priv *priv)
>  		return 0;
>  	}
>  
> -	skb = dev_alloc_skb(len);
> +
> +	/* Firmware may insert up to 4 padding bytes after the lmac header,
> +	 * but it does not amend the size of SPI data transfer.
> +	 * Such packets has correct data size in header, thus referencing
> +	 * past the end of allocated skb. Reserve extra 4 bytes for this case */
> +	skb = dev_alloc_skb(len + 4);
>  	if (!skb) {
>  		dev_err(&priv->spi->dev, "could not alloc skb");
>  		return 0;
> @@ -389,6 +394,9 @@ static int p54spi_rx(struct p54s_priv *priv)
>  
>  	p54spi_spi_read(priv, SPI_ADRS_DMA_DATA, skb_put(skb, len), len);
>  	p54spi_sleep(priv);
> +	/* Put additional bytes to compensate for the possible
> +	 * alignment-caused truncation */
> +	skb_put(skb, 4);
>  
>  	if (p54_rx(priv->hw, skb) == 0)
>  		dev_kfree_skb(skb);