aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorJon Mason <jdmason@us.ibm.com>2006-03-10 16:12:10 -0500
committerJeff Garzik <jeff@garzik.org>2006-03-11 13:26:51 -0500
commit9ee09d9cd4f57bae9cd95ea7ae5f41c29a166361 (patch)
tree2b769501f13fabaa472c2ac3a4f5099a530770c2 /drivers/net
parent9e927fb6186b6913d47d33068160088a084d568e (diff)
[PATCH] dl2k: DMA freeing error
This patch fixes an error in the dl2k driver's DMA mapping/unmapping. The adapter uses the upper 16bits of the DMA address for the buffer size. However, this is not masked off when referencing the DMA address, and can lead to errors by trying to free a DMA address out of range. Thanks, Jon Signed-off-by: Jon Mason <jdmason@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/dl2k.c25
1 files changed, 15 insertions, 10 deletions
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 430c628279b3..fb9dae302dcc 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -50,8 +50,8 @@
50 50
51*/ 51*/
52#define DRV_NAME "D-Link DL2000-based linux driver" 52#define DRV_NAME "D-Link DL2000-based linux driver"
53#define DRV_VERSION "v1.17a" 53#define DRV_VERSION "v1.17b"
54#define DRV_RELDATE "2002/10/04" 54#define DRV_RELDATE "2006/03/10"
55#include "dl2k.h" 55#include "dl2k.h"
56 56
57static char version[] __devinitdata = 57static char version[] __devinitdata =
@@ -765,7 +765,7 @@ rio_free_tx (struct net_device *dev, int irq)
765 break; 765 break;
766 skb = np->tx_skbuff[entry]; 766 skb = np->tx_skbuff[entry];
767 pci_unmap_single (np->pdev, 767 pci_unmap_single (np->pdev,
768 np->tx_ring[entry].fraginfo, 768 np->tx_ring[entry].fraginfo & 0xffffffffffff,
769 skb->len, PCI_DMA_TODEVICE); 769 skb->len, PCI_DMA_TODEVICE);
770 if (irq) 770 if (irq)
771 dev_kfree_skb_irq (skb); 771 dev_kfree_skb_irq (skb);
@@ -892,14 +892,16 @@ receive_packet (struct net_device *dev)
892 892
893 /* Small skbuffs for short packets */ 893 /* Small skbuffs for short packets */
894 if (pkt_len > copy_thresh) { 894 if (pkt_len > copy_thresh) {
895 pci_unmap_single (np->pdev, desc->fraginfo, 895 pci_unmap_single (np->pdev,
896 desc->fraginfo & 0xffffffffffff,
896 np->rx_buf_sz, 897 np->rx_buf_sz,
897 PCI_DMA_FROMDEVICE); 898 PCI_DMA_FROMDEVICE);
898 skb_put (skb = np->rx_skbuff[entry], pkt_len); 899 skb_put (skb = np->rx_skbuff[entry], pkt_len);
899 np->rx_skbuff[entry] = NULL; 900 np->rx_skbuff[entry] = NULL;
900 } else if ((skb = dev_alloc_skb (pkt_len + 2)) != NULL) { 901 } else if ((skb = dev_alloc_skb (pkt_len + 2)) != NULL) {
901 pci_dma_sync_single_for_cpu(np->pdev, 902 pci_dma_sync_single_for_cpu(np->pdev,
902 desc->fraginfo, 903 desc->fraginfo &
904 0xffffffffffff,
903 np->rx_buf_sz, 905 np->rx_buf_sz,
904 PCI_DMA_FROMDEVICE); 906 PCI_DMA_FROMDEVICE);
905 skb->dev = dev; 907 skb->dev = dev;
@@ -910,7 +912,8 @@ receive_packet (struct net_device *dev)
910 pkt_len, 0); 912 pkt_len, 0);
911 skb_put (skb, pkt_len); 913 skb_put (skb, pkt_len);
912 pci_dma_sync_single_for_device(np->pdev, 914 pci_dma_sync_single_for_device(np->pdev,
913 desc->fraginfo, 915 desc->fraginfo &
916 0xffffffffffff,
914 np->rx_buf_sz, 917 np->rx_buf_sz,
915 PCI_DMA_FROMDEVICE); 918 PCI_DMA_FROMDEVICE);
916 } 919 }
@@ -1796,8 +1799,9 @@ rio_close (struct net_device *dev)
1796 np->rx_ring[i].fraginfo = 0; 1799 np->rx_ring[i].fraginfo = 0;
1797 skb = np->rx_skbuff[i]; 1800 skb = np->rx_skbuff[i];
1798 if (skb) { 1801 if (skb) {
1799 pci_unmap_single (np->pdev, np->rx_ring[i].fraginfo, 1802 pci_unmap_single(np->pdev,
1800 skb->len, PCI_DMA_FROMDEVICE); 1803 np->rx_ring[i].fraginfo & 0xffffffffffff,
1804 skb->len, PCI_DMA_FROMDEVICE);
1801 dev_kfree_skb (skb); 1805 dev_kfree_skb (skb);
1802 np->rx_skbuff[i] = NULL; 1806 np->rx_skbuff[i] = NULL;
1803 } 1807 }
@@ -1805,8 +1809,9 @@ rio_close (struct net_device *dev)
1805 for (i = 0; i < TX_RING_SIZE; i++) { 1809 for (i = 0; i < TX_RING_SIZE; i++) {
1806 skb = np->tx_skbuff[i]; 1810 skb = np->tx_skbuff[i];
1807 if (skb) { 1811 if (skb) {
1808 pci_unmap_single (np->pdev, np->tx_ring[i].fraginfo, 1812 pci_unmap_single(np->pdev,
1809 skb->len, PCI_DMA_TODEVICE); 1813 np->tx_ring[i].fraginfo & 0xffffffffffff,
1814 skb->len, PCI_DMA_TODEVICE);
1810 dev_kfree_skb (skb); 1815 dev_kfree_skb (skb);
1811 np->tx_skbuff[i] = NULL; 1816 np->tx_skbuff[i] = NULL;
1812 } 1817 }