* [Patch] Array overrun in drivers/net/tokenring/3c359.c
@ 2006-06-21 14:33 Eric Sesterhenn
0 siblings, 0 replies; only message in thread
From: Eric Sesterhenn @ 2006-06-21 14:33 UTC (permalink / raw)
To: linux-kernel; +Cc: mikep
hi,
this was spotted by coverity (#id 502)
the xl_laa[] array has only 6 entries, since the else
case uses i-10 as array index to dev->dev_addr[] i guess
thats what should be done here too
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.17-git2/drivers/net/tokenring/3c359.c.orig 2006-06-21 16:31:36.000000000 +0200
+++ linux-2.6.17-git2/drivers/net/tokenring/3c359.c 2006-06-21 16:31:41.000000000 +0200
@@ -764,7 +764,7 @@ static int xl_open_hw(struct net_device
if (xl_priv->xl_laa[0]) { /* If using a LAA address */
for (i=10;i<16;i++) {
writel( (MEM_BYTE_WRITE | 0xD0000 | xl_priv->srb) + i, xl_mmio + MMIO_MAC_ACCESS_CMD) ;
- writeb(xl_priv->xl_laa[i],xl_mmio + MMIO_MACDATA) ;
+ writeb(xl_priv->xl_laa[i-10],xl_mmio + MMIO_MACDATA) ;
}
memcpy(dev->dev_addr,xl_priv->xl_laa,dev->addr_len) ;
} else { /* Regular hardware address */
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2006-06-21 14:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-06-21 14:33 [Patch] Array overrun in drivers/net/tokenring/3c359.c Eric Sesterhenn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox