summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorStephen Hemminger <shemminger@vyatta.com>2008-07-25 12:07:22 -0700
committerJeff Garzik <jgarzik@redhat.com>2008-08-07 02:22:15 -0400
commit9a5d3414202a21ed4b053657345ea0fd492d513a (patch)
treed29ea012a7c924bda9a624476f1c3ad093642744 /drivers
parentb11f8d8cc3bb2fa6fa55286babc1a5ebb2e932c4 (diff)
downloadlinux-3.10-9a5d3414202a21ed4b053657345ea0fd492d513a.tar.gz
linux-3.10-9a5d3414202a21ed4b053657345ea0fd492d513a.tar.bz2
linux-3.10-9a5d3414202a21ed4b053657345ea0fd492d513a.zip
3c59x: use netdev_alloc_skb
Fix possible bug where end of receive buffer could be overwritten. The allocation needs to allow for the reserved space. This would only happen if device received packet greater than Ethernet standard MTU. Change this driver to use netdev_alloc_skb rather than setting skb->dev directly. For the initial allocation it doesn't need to be GFP_ATOMIC. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/3c59x.c14
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 8db4e6b8948..491ee16da5c 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1692,12 +1692,14 @@ vortex_open(struct net_device *dev)
vp->rx_ring[i].next = cpu_to_le32(vp->rx_ring_dma + sizeof(struct boom_rx_desc) * (i+1));
vp->rx_ring[i].status = 0; /* Clear complete bit. */
vp->rx_ring[i].length = cpu_to_le32(PKT_BUF_SZ | LAST_FRAG);
- skb = dev_alloc_skb(PKT_BUF_SZ);
+
+ skb = __netdev_alloc_skb(dev, PKT_BUF_SZ + NET_IP_ALIGN,
+ GFP_KERNEL);
vp->rx_skbuff[i] = skb;
if (skb == NULL)
break; /* Bad news! */
- skb->dev = dev; /* Mark as being used by this device. */
- skb_reserve(skb, 2); /* Align IP on 16 byte boundaries */
+
+ skb_reserve(skb, NET_IP_ALIGN); /* Align IP on 16 byte boundaries */
vp->rx_ring[i].addr = cpu_to_le32(pci_map_single(VORTEX_PCI(vp), skb->data, PKT_BUF_SZ, PCI_DMA_FROMDEVICE));
}
if (i != RX_RING_SIZE) {
@@ -2538,7 +2540,7 @@ boomerang_rx(struct net_device *dev)
struct sk_buff *skb;
entry = vp->dirty_rx % RX_RING_SIZE;
if (vp->rx_skbuff[entry] == NULL) {
- skb = dev_alloc_skb(PKT_BUF_SZ);
+ skb = netdev_alloc_skb(dev, PKT_BUF_SZ + NET_IP_ALIGN);
if (skb == NULL) {
static unsigned long last_jif;
if (time_after(jiffies, last_jif + 10 * HZ)) {
@@ -2549,8 +2551,8 @@ boomerang_rx(struct net_device *dev)
mod_timer(&vp->rx_oom_timer, RUN_AT(HZ * 1));
break; /* Bad news! */
}
- skb->dev = dev; /* Mark as being used by this device. */
- skb_reserve(skb, 2); /* Align IP on 16 byte boundaries */
+
+ skb_reserve(skb, NET_IP_ALIGN);
vp->rx_ring[entry].addr = cpu_to_le32(pci_map_single(VORTEX_PCI(vp), skb->data, PKT_BUF_SZ, PCI_DMA_FROMDEVICE));
vp->rx_skbuff[entry] = skb;
}