Patchwork beyond ARRAY_SIZE of ib->btx_ring

login
register
mail settings
Submitter roel kluin
Date Feb. 22, 2009, 1:40 a.m.
Message ID <49A0AD1D.1@gmail.com>
Download mbox | patch
Permalink /patch/23523/
State Accepted
Delegated to: David Miller
Headers show

Comments

roel kluin - Feb. 22, 2009, 1:40 a.m.
// vi drivers/net/sunlance.c +216
struct lance_init_block {
...
        struct lance_tx_desc btx_ring[TX_RING_SIZE];
...
};
This is a bug, isn't it?
--------------------------->8-------------8<------------------------------
Do not go beyond ARRAY_SIZE of ib->btx_ring

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - Feb. 22, 2009, 7:46 a.m.
From: Roel Kluin <roel.kluin@gmail.com>
Date: Sun, 22 Feb 2009 02:40:45 +0100

> // vi drivers/net/sunlance.c +216
> struct lance_init_block {
> ...
>         struct lance_tx_desc btx_ring[TX_RING_SIZE];
> ...
> };
> This is a bug, isn't it?

Yep, luckily this is harmless since it just puts a turd
into the TX buffers.

> Do not go beyond ARRAY_SIZE of ib->btx_ring
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 2813732..16c528d 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -343,7 +343,7 @@  static void lance_init_ring_dvma(struct net_device *dev)
 	ib->phys_addr [5] = dev->dev_addr [4];
 
 	/* Setup the Tx ring entries */
-	for (i = 0; i <= TX_RING_SIZE; i++) {
+	for (i = 0; i < TX_RING_SIZE; i++) {
 		leptr = LANCE_ADDR(aib + libbuff_offset(tx_buf, i));
 		ib->btx_ring [i].tmd0      = leptr;
 		ib->btx_ring [i].tmd1_hadr = leptr >> 16;
@@ -399,7 +399,7 @@  static void lance_init_ring_pio(struct net_device *dev)
 	sbus_writeb(dev->dev_addr[4], &ib->phys_addr[5]);
 
 	/* Setup the Tx ring entries */
-	for (i = 0; i <= TX_RING_SIZE; i++) {
+	for (i = 0; i < TX_RING_SIZE; i++) {
 		leptr = libbuff_offset(tx_buf, i);
 		sbus_writew(leptr,	&ib->btx_ring [i].tmd0);
 		sbus_writeb(leptr >> 16,&ib->btx_ring [i].tmd1_hadr);