* [PATCH] beyond ARRAY_SIZE of ib->btx_ring
@ 2009-02-22 1:40 Roel Kluin
2009-02-22 7:46 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Roel Kluin @ 2009-02-22 1:40 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, Andrew Morton
// vi drivers/net/sunlance.c +216
struct lance_init_block {
...
struct lance_tx_desc btx_ring[TX_RING_SIZE];
...
};
This is a bug, isn't it?
--------------------------->8-------------8<------------------------------
Do not go beyond ARRAY_SIZE of ib->btx_ring
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 2813732..16c528d 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -343,7 +343,7 @@ static void lance_init_ring_dvma(struct net_device *dev)
ib->phys_addr [5] = dev->dev_addr [4];
/* Setup the Tx ring entries */
- for (i = 0; i <= TX_RING_SIZE; i++) {
+ for (i = 0; i < TX_RING_SIZE; i++) {
leptr = LANCE_ADDR(aib + libbuff_offset(tx_buf, i));
ib->btx_ring [i].tmd0 = leptr;
ib->btx_ring [i].tmd1_hadr = leptr >> 16;
@@ -399,7 +399,7 @@ static void lance_init_ring_pio(struct net_device *dev)
sbus_writeb(dev->dev_addr[4], &ib->phys_addr[5]);
/* Setup the Tx ring entries */
- for (i = 0; i <= TX_RING_SIZE; i++) {
+ for (i = 0; i < TX_RING_SIZE; i++) {
leptr = libbuff_offset(tx_buf, i);
sbus_writew(leptr, &ib->btx_ring [i].tmd0);
sbus_writeb(leptr >> 16,&ib->btx_ring [i].tmd1_hadr);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] beyond ARRAY_SIZE of ib->btx_ring
2009-02-22 1:40 [PATCH] beyond ARRAY_SIZE of ib->btx_ring Roel Kluin
@ 2009-02-22 7:46 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2009-02-22 7:46 UTC (permalink / raw)
To: roel.kluin; +Cc: netdev, akpm
From: Roel Kluin <roel.kluin@gmail.com>
Date: Sun, 22 Feb 2009 02:40:45 +0100
> // vi drivers/net/sunlance.c +216
> struct lance_init_block {
> ...
> struct lance_tx_desc btx_ring[TX_RING_SIZE];
> ...
> };
> This is a bug, isn't it?
Yep, luckily this is harmless since it just puts a turd
into the TX buffers.
> Do not go beyond ARRAY_SIZE of ib->btx_ring
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-02-22 7:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-02-22 1:40 [PATCH] beyond ARRAY_SIZE of ib->btx_ring Roel Kluin
2009-02-22 7:46 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).