1 From 632da4d66324b5baf947a048dd1f1e9093b6dd90 Mon Sep 17 00:00:00 2001
2 From: Eilon Greenstein <eilong@broadcom.com>
3 Date: Wed, 14 Jan 2009 06:44:10 +0000
4 Subject: bnx2x: Overstepping array bounds
5 Acked-by: Karsten Keil <kkeil@novell.com>
8 If the page size is > 8KB this violation happens
10 Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
11 Signed-off-by: David S. Miller <davem@davemloft.net>
13 drivers/net/bnx2x_main.c | 4 ++++
14 1 files changed, 4 insertions(+), 0 deletions(-)
16 Index: linux-2.6.27-bnx2x_2/drivers/net/bnx2x_main.c
17 ===================================================================
18 --- linux-2.6.27-bnx2x_2.orig/drivers/net/bnx2x_main.c
19 +++ linux-2.6.27-bnx2x_2/drivers/net/bnx2x_main.c
20 @@ -9431,6 +9431,7 @@ static inline u32 bnx2x_xmit_type(struct
24 +#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
25 /* check if packet requires linearization (packet is too fragmented) */
26 static int bnx2x_pkt_req_lin(struct bnx2x *bp, struct sk_buff *skb,
28 @@ -9508,6 +9509,7 @@ exit_lbl:
34 /* called with netif_tx_lock
35 * bnx2x_tx_int() runs without netif_tx_lock unless it needs to call
36 @@ -9548,6 +9550,7 @@ static int bnx2x_start_xmit(struct sk_bu
37 skb->ip_summed, skb->protocol, ipv6_hdr(skb)->nexthdr,
38 ip_hdr(skb)->protocol, skb_shinfo(skb)->gso_type, xmit_type);
40 +#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
41 /* First, check if we need to linearize the skb
42 (due to FW restrictions) */
43 if (bnx2x_pkt_req_lin(bp, skb, xmit_type)) {
44 @@ -9560,6 +9563,7 @@ static int bnx2x_start_xmit(struct sk_bu
51 Please read carefully. First we use one BD which we mark as start,