Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4c537e63 authored by Jon Smirl's avatar Jon Smirl Committed by Jeff Garzik
Browse files

Fix memory corruption in fec_mpc52xx 



The mpc5200 fec driver is corrupting memory. This patch fixes two bugs
where the wrong skb was being referenced.

Signed-off-by: default avatarJon Smirl <jonsmirl@gmail.com>
Acked-by: default avatarDomen Puncer <domen.puncer@telargo.com>
Signed-off-by: default avatarGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent 0581d3f5

drivers/net/fec_mpc52xx.c

+2 −2
Original line number Diff line number Diff line
@@ -422,7 +422,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id) 


		rskb = bcom_retrieve_buffer(priv->rx_dmatsk, &status,

				(struct bcom_bd **)&bd);

		dma_unmap_single(&dev->dev, bd->skb_pa, skb->len, DMA_FROM_DEVICE);

		dma_unmap_single(&dev->dev, bd->skb_pa, rskb->len, DMA_FROM_DEVICE);



		/* Test for errors in received frame */

		if (status & BCOM_FEC_RX_BD_ERRORS) {
@@ -467,7 +467,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id) 
			bcom_prepare_next_buffer(priv->rx_dmatsk);



		bd->status = FEC_RX_BUFFER_SIZE;

		bd->skb_pa = dma_map_single(&dev->dev, rskb->data,

		bd->skb_pa = dma_map_single(&dev->dev, skb->data,

				FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);



		bcom_submit_next_buffer(priv->rx_dmatsk, skb);