]>
Commit | Line | Data |
---|---|---|
2cb7cef9 BS |
1 | From 632da4d66324b5baf947a048dd1f1e9093b6dd90 Mon Sep 17 00:00:00 2001 |
2 | From: Eilon Greenstein <eilong@broadcom.com> | |
3 | Date: Wed, 14 Jan 2009 06:44:10 +0000 | |
4 | Subject: bnx2x: Overstepping array bounds | |
5 | Acked-by: Karsten Keil <kkeil@novell.com> | |
6 | Reference: bnc#472500 | |
7 | ||
8 | If the page size is > 8KB this violation happens | |
9 | ||
10 | Signed-off-by: Eilon Greenstein <eilong@broadcom.com> | |
11 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
12 | --- | |
13 | drivers/net/bnx2x_main.c | 4 ++++ | |
14 | 1 files changed, 4 insertions(+), 0 deletions(-) | |
15 | ||
16 | Index: linux-2.6.27-bnx2x_2/drivers/net/bnx2x_main.c | |
17 | =================================================================== | |
18 | --- linux-2.6.27-bnx2x_2.orig/drivers/net/bnx2x_main.c | |
19 | +++ linux-2.6.27-bnx2x_2/drivers/net/bnx2x_main.c | |
20 | @@ -9431,6 +9431,7 @@ static inline u32 bnx2x_xmit_type(struct | |
21 | return rc; | |
22 | } | |
23 | ||
24 | +#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3) | |
25 | /* check if packet requires linearization (packet is too fragmented) */ | |
26 | static int bnx2x_pkt_req_lin(struct bnx2x *bp, struct sk_buff *skb, | |
27 | u32 xmit_type) | |
28 | @@ -9508,6 +9509,7 @@ exit_lbl: | |
29 | ||
30 | return to_copy; | |
31 | } | |
32 | +#endif | |
33 | ||
34 | /* called with netif_tx_lock | |
35 | * bnx2x_tx_int() runs without netif_tx_lock unless it needs to call | |
36 | @@ -9548,6 +9550,7 @@ static int bnx2x_start_xmit(struct sk_bu | |
37 | skb->ip_summed, skb->protocol, ipv6_hdr(skb)->nexthdr, | |
38 | ip_hdr(skb)->protocol, skb_shinfo(skb)->gso_type, xmit_type); | |
39 | ||
40 | +#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3) | |
41 | /* First, check if we need to linearize the skb | |
42 | (due to FW restrictions) */ | |
43 | if (bnx2x_pkt_req_lin(bp, skb, xmit_type)) { | |
44 | @@ -9560,6 +9563,7 @@ static int bnx2x_start_xmit(struct sk_bu | |
45 | return NETDEV_TX_OK; | |
46 | } | |
47 | } | |
48 | +#endif | |
49 | ||
50 | /* | |
51 | Please read carefully. First we use one BD which we mark as start, |