src/patches/suse-2.6.27.25/patches.drivers/bnx2x-Overstepping-array-bounds.patch

   1 From 632da4d66324b5baf947a048dd1f1e9093b6dd90 Mon Sep 17 00:00:00 2001
   2 From: Eilon Greenstein <eilong@broadcom.com>
   3 Date: Wed, 14 Jan 2009 06:44:10 +0000
   4 Subject: bnx2x: Overstepping array bounds
   5 Acked-by: Karsten Keil <kkeil@novell.com>
   6 Reference: bnc#472500
   7
   8 If the page size is > 8KB this violation happens
   9
  10 Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
  11 Signed-off-by: David S. Miller <davem@davemloft.net>
  12 ---
  13  drivers/net/bnx2x_main.c |    4 ++++
  14  1 files changed, 4 insertions(+), 0 deletions(-)
  15
  16 Index: linux-2.6.27-bnx2x_2/drivers/net/bnx2x_main.c
  17 ===================================================================
  18 --- linux-2.6.27-bnx2x_2.orig/drivers/net/bnx2x_main.c
  19 +++ linux-2.6.27-bnx2x_2/drivers/net/bnx2x_main.c
  20 @@ -9431,6 +9431,7 @@ static inline u32 bnx2x_xmit_type(struct
  21         return rc;
  22  }
  23
  24 +#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
  25  /* check if packet requires linearization (packet is too fragmented) */
  26  static int bnx2x_pkt_req_lin(struct bnx2x *bp, struct sk_buff *skb,
  27                              u32 xmit_type)
  28 @@ -9508,6 +9509,7 @@ exit_lbl:
  29
  30         return to_copy;
  31  }
  32 +#endif
  33
  34  /* called with netif_tx_lock
  35   * bnx2x_tx_int() runs without netif_tx_lock unless it needs to call
  36 @@ -9548,6 +9550,7 @@ static int bnx2x_start_xmit(struct sk_bu
  37            skb->ip_summed, skb->protocol, ipv6_hdr(skb)->nexthdr,
  38            ip_hdr(skb)->protocol, skb_shinfo(skb)->gso_type, xmit_type);
  39
  40 +#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
  41         /* First, check if we need to linearize the skb
  42            (due to FW restrictions) */
  43         if (bnx2x_pkt_req_lin(bp, skb, xmit_type)) {
  44 @@ -9560,6 +9563,7 @@ static int bnx2x_start_xmit(struct sk_bu
  45                         return NETDEV_TX_OK;
  46                 }
  47         }
  48 +#endif
  49
  50         /*
  51         Please read carefully. First we use one BD which we mark as start,