KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix a memory corruption bug in the linux 2.4 version of b44

Browse source 
SVN-Revision: 13955
This commit is contained in:
Felix Fietkau 2009-01-10 00:55:38 +00:00
parent df5b0fe1ca
commit f57651b042
1 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
target/linux/brcm-2.4/patches/110-b44_alignment.patch
View file

@ -10,19 +10,19 @@
/* minimum number of free TX descriptors required to wake up TX process */ /* minimum number of free TX descriptors required to wake up TX process */
#define B44_TX_WAKEUP_THRESH (B44_TX_RING_SIZE / 4) #define B44_TX_WAKEUP_THRESH (B44_TX_RING_SIZE / 4)
@@ -734,10 +735,9 @@ static int b44_alloc_rx_skb(struct b44 * @@ -734,10 +735,8 @@ static int b44_alloc_rx_skb(struct b44 *
mapping = pci_map_single(bp->pdev, skb->data, mapping = pci_map_single(bp->pdev, skb->data,
RX_PKT_BUF_SZ, RX_PKT_BUF_SZ,
PCI_DMA_FROMDEVICE); PCI_DMA_FROMDEVICE);
- skb_reserve(skb, bp->rx_offset); - skb_reserve(skb, bp->rx_offset);
rh = (struct rx_header *) - rh = (struct rx_header *)
- (skb->data - bp->rx_offset); - (skb->data - bp->rx_offset);
+ (skb->data - RX_HEADER_OFS); + rh = (struct rx_header *) skb->data;
rh->len = 0; rh->len = 0;
rh->flags = 0; rh->flags = 0;
@@ -747,13 +747,13 @@ static int b44_alloc_rx_skb(struct b44 * @@ -747,13 +746,13 @@ static int b44_alloc_rx_skb(struct b44 *
if (src_map != NULL) if (src_map != NULL)
src_map->skb = NULL; src_map->skb = NULL;
@ -38,7 +38,7 @@
return RX_PKT_BUF_SZ; return RX_PKT_BUF_SZ;
} }
@@ -812,7 +812,7 @@ static int b44_rx(struct b44 *bp, int bu @@ -812,7 +811,7 @@ static int b44_rx(struct b44 *bp, int bu
PCI_DMA_FROMDEVICE); PCI_DMA_FROMDEVICE);
rh = (struct rx_header *) skb->data; rh = (struct rx_header *) skb->data;
len = cpu_to_le16(rh->len); len = cpu_to_le16(rh->len);
@ -47,7 +47,7 @@
(rh->flags & cpu_to_le16(RX_FLAG_ERRORS))) { (rh->flags & cpu_to_le16(RX_FLAG_ERRORS))) {
drop_it: drop_it:
b44_recycle_rx(bp, cons, bp->rx_prod); b44_recycle_rx(bp, cons, bp->rx_prod);
@@ -844,8 +844,8 @@ static int b44_rx(struct b44 *bp, int bu @@ -844,8 +843,8 @@ static int b44_rx(struct b44 *bp, int bu
pci_unmap_single(bp->pdev, map, pci_unmap_single(bp->pdev, map,
skb_size, PCI_DMA_FROMDEVICE); skb_size, PCI_DMA_FROMDEVICE);
/* Leave out rx_header */ /* Leave out rx_header */
@ -58,7 +58,7 @@
} else { } else {
struct sk_buff *copy_skb; struct sk_buff *copy_skb;
@@ -858,7 +858,7 @@ static int b44_rx(struct b44 *bp, int bu @@ -858,7 +857,7 @@ static int b44_rx(struct b44 *bp, int bu
skb_reserve(copy_skb, 2); skb_reserve(copy_skb, 2);
skb_put(copy_skb, len); skb_put(copy_skb, len);
/* DMA sync done above, copy just the actual packet */ /* DMA sync done above, copy just the actual packet */
@ -67,7 +67,7 @@
skb = copy_skb; skb = copy_skb;
} }
@@ -1344,7 +1344,7 @@ static void b44_init_hw(struct b44 *bp) @@ -1344,7 +1343,7 @@ static void b44_init_hw(struct b44 *bp)
bw32(B44_DMATX_CTRL, DMATX_CTRL_ENABLE); bw32(B44_DMATX_CTRL, DMATX_CTRL_ENABLE);
bw32(B44_DMATX_ADDR, bp->tx_ring_dma + bp->dma_offset); bw32(B44_DMATX_ADDR, bp->tx_ring_dma + bp->dma_offset);
bw32(B44_DMARX_CTRL, (DMARX_CTRL_ENABLE | bw32(B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
@ -76,7 +76,7 @@
bw32(B44_DMARX_ADDR, bp->rx_ring_dma + bp->dma_offset); bw32(B44_DMARX_ADDR, bp->rx_ring_dma + bp->dma_offset);
bw32(B44_DMARX_PTR, bp->rx_pending); bw32(B44_DMARX_PTR, bp->rx_pending);
@@ -1873,13 +1873,7 @@ static int __devinit b44_get_invariants( @@ -1873,13 +1872,7 @@ static int __devinit b44_get_invariants(
bp->mdc_port = (eeprom[90] >> 14) & 0x1; bp->mdc_port = (eeprom[90] >> 14) & 0x1;
} }