From: Jon Smirl Date: Mon, 3 Dec 2007 22:38:10 +0000 (+0000) Subject: Fix memory corruption in fec_mpc52xx X-Git-Tag: v2.6.24-rc5~106^2~5 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c537e6371a9510c82eb96fb7e1e66017e0e2053;p=linux-2.6 Fix memory corruption in fec_mpc52xx The mpc5200 fec driver is corrupting memory. This patch fixes two bugs where the wrong skb was being referenced. Signed-off-by: Jon Smirl Acked-by: Domen Puncer Signed-off-by: Grant Likely Signed-off-by: David Woodhouse Signed-off-by: Jeff Garzik --- diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c index bf5a7caa5b..79f7eade47 100644 --- a/drivers/net/fec_mpc52xx.c +++ b/drivers/net/fec_mpc52xx.c @@ -422,7 +422,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id) rskb = bcom_retrieve_buffer(priv->rx_dmatsk, &status, (struct bcom_bd **)&bd); - dma_unmap_single(&dev->dev, bd->skb_pa, skb->len, DMA_FROM_DEVICE); + dma_unmap_single(&dev->dev, bd->skb_pa, rskb->len, DMA_FROM_DEVICE); /* Test for errors in received frame */ if (status & BCOM_FEC_RX_BD_ERRORS) { @@ -467,7 +467,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id) bcom_prepare_next_buffer(priv->rx_dmatsk); bd->status = FEC_RX_BUFFER_SIZE; - bd->skb_pa = dma_map_single(&dev->dev, rskb->data, + bd->skb_pa = dma_map_single(&dev->dev, skb->data, FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE); bcom_submit_next_buffer(priv->rx_dmatsk, skb);