Commit 2a5a259f authored by David S. Miller's avatar David S. Miller

Merge branch 'sh_eth-fixes'

Sergei Shtylyov says:

====================
sh_eth: fix couple of bugs in sh_eth_ring_format()

   Here's a set of 2 patches against DaveM's 'net.git' repo fixing two bugs
in sh_eth_.ring_format()...

[1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
[2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f720d0ca d0ba9134
...@@ -1127,11 +1127,8 @@ static void sh_eth_ring_format(struct net_device *ndev) ...@@ -1127,11 +1127,8 @@ static void sh_eth_ring_format(struct net_device *ndev)
break; break;
sh_eth_set_receive_align(skb); sh_eth_set_receive_align(skb);
/* RX descriptor */
rxdesc = &mdp->rx_ring[i];
/* The size of the buffer is a multiple of 32 bytes. */ /* The size of the buffer is a multiple of 32 bytes. */
buf_len = ALIGN(mdp->rx_buf_sz, 32); buf_len = ALIGN(mdp->rx_buf_sz, 32);
rxdesc->len = cpu_to_le32(buf_len << 16);
dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len, dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
DMA_FROM_DEVICE); DMA_FROM_DEVICE);
if (dma_mapping_error(&ndev->dev, dma_addr)) { if (dma_mapping_error(&ndev->dev, dma_addr)) {
...@@ -1139,6 +1136,10 @@ static void sh_eth_ring_format(struct net_device *ndev) ...@@ -1139,6 +1136,10 @@ static void sh_eth_ring_format(struct net_device *ndev)
break; break;
} }
mdp->rx_skbuff[i] = skb; mdp->rx_skbuff[i] = skb;
/* RX descriptor */
rxdesc = &mdp->rx_ring[i];
rxdesc->len = cpu_to_le32(buf_len << 16);
rxdesc->addr = cpu_to_le32(dma_addr); rxdesc->addr = cpu_to_le32(dma_addr);
rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP); rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP);
...@@ -1154,6 +1155,7 @@ static void sh_eth_ring_format(struct net_device *ndev) ...@@ -1154,6 +1155,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);
/* Mark the last entry as wrapping the ring. */ /* Mark the last entry as wrapping the ring. */
if (rxdesc)
rxdesc->status |= cpu_to_le32(RD_RDLE); rxdesc->status |= cpu_to_le32(RD_RDLE);
memset(mdp->tx_ring, 0, tx_ringsize); memset(mdp->tx_ring, 0, tx_ringsize);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment