From: Jeff Garzik <jgarzik@pobox.com>
To: David Woodhouse <dwmw2@infradead.org>
Cc: netdev@vger.kernel.org, Domen Puncer <domen.puncer@telargo.com>,
Jon Smirl <jonsmirl@gmail.com>,
Grant Likely <grant.likely@secretlab.ca>
Subject: Re: [PATCH] Fix memory corruption in fec_mpc52xx
Date: Tue, 04 Dec 2007 14:54:17 -0500 [thread overview]
Message-ID: <4755B069.3050901@pobox.com> (raw)
In-Reply-To: <1196721490.13978.185.camel@pmac.infradead.org>
David Woodhouse wrote:
> From: Jon Smirl <jonsmirl@gmail.com>
>
> The mpc5200 fec driver is corrupting memory. This patch fixes two bugs
> where the wrong skb was being referenced.
>
> Signed-off-by: Jon Smirl <jonsmirl@gmail.com>
> Acked-by: Domen Puncer <domen.puncer@telargo.com>
> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
>
> --- a/drivers/net/fec_mpc52xx.c
> +++ b/drivers/net/fec_mpc52xx.c
> @@ -422,7 +422,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
>
> rskb = bcom_retrieve_buffer(priv->rx_dmatsk, &status,
> (struct bcom_bd **)&bd);
> - dma_unmap_single(&dev->dev, bd->skb_pa, skb->len, DMA_FROM_DEVICE);
> + dma_unmap_single(&dev->dev, bd->skb_pa, rskb->len, DMA_FROM_DEVICE);
>
> /* Test for errors in received frame */
> if (status & BCOM_FEC_RX_BD_ERRORS) {
> @@ -467,7 +467,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
> bcom_prepare_next_buffer(priv->rx_dmatsk);
>
> bd->status = FEC_RX_BUFFER_SIZE;
> - bd->skb_pa = dma_map_single(&dev->dev, rskb->data,
> + bd->skb_pa = dma_map_single(&dev->dev, skb->data,
> FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);
>
applied #upstream-fixes
prev parent reply other threads:[~2007-12-04 19:54 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-12-03 22:38 [PATCH] Fix memory corruption in fec_mpc52xx David Woodhouse
2007-12-03 22:51 ` Jon Smirl
2007-12-04 19:54 ` Jeff Garzik [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4755B069.3050901@pobox.com \
--to=jgarzik@pobox.com \
--cc=domen.puncer@telargo.com \
--cc=dwmw2@infradead.org \
--cc=grant.likely@secretlab.ca \
--cc=jonsmirl@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).