[PATCH-2.2.19] bug in cs89x0

[PATCH-2.2.19] bug in cs89x0

[Kapr Johnik]

Hi to all.

I think I've found bug in the cs89x0 network driver in 2.2.19, which we 
are using in an embedded network router. The driver does not use 
skb_put(), instead it writes directly to skb->len and leaves skb->tail 
incorrect. Patch follows.

diff -u -r linux-2.2.19/drivers/net/cs89x0.c linux/drivers/net/cs89x0.c
--- linux-2.2.19/drivers/net/cs89x0.c	Sun Mar 25 18:37:34 2001
+++ linux/drivers/net/cs89x0.c	Tue Sep 25 09:39:35 2001
@@ -904,7 +904,7 @@
 		lp->stats.rx_dropped++;
 		return;
 	}
-	skb->len = length;
+	skb_put(skb, length);
 	skb->dev = dev;
 
         insw(ioaddr + RX_FRAME_PORT, skb->data, length >> 1);

Re: [PATCH-2.2.19] bug in cs89x0

[David Weinehall]

On Tue, Sep 25, 2001 at 10:11:42AM +0200, Kapr Johnik wrote:
> Hi to all.
> 
> I think I've found bug in the cs89x0 network driver in 2.2.19, which we 
> are using in an embedded network router. The driver does not use 
> skb_put(), instead it writes directly to skb->len and leaves skb->tail 
> incorrect. Patch follows.

The same error exists in the v2.4-kernel, drivers/net/mac89x0.c


/David Weinehall

--- linux-2.4.10/drivers/net/mac89x0.c.old	Wed Sep 26 00:45:44 2001
+++ linux-2.4.10/drivers/net/mac89x0.c	Wed Sep 26 00:46:34 2001
@@ -524,7 +524,7 @@
 		lp->stats.rx_dropped++;
 		return;
 	}
-	skb->len = length;
+	skb_put(skb, length);
 	skb->dev = dev;
 
 	memcpy_fromio(skb->data, dev->mem_start + PP_RxFrame, length);