From patchwork Wed May 26 20:48:53 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 102506 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o4QKnZhD027233 for ; Wed, 26 May 2010 20:49:35 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932892Ab0EZUtD (ORCPT ); Wed, 26 May 2010 16:49:03 -0400 Received: from mail-fx0-f46.google.com ([209.85.161.46]:58839 "EHLO mail-fx0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753981Ab0EZUtA (ORCPT ); Wed, 26 May 2010 16:49:00 -0400 Received: by fxm5 with SMTP id 5so4901386fxm.19 for ; Wed, 26 May 2010 13:48:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:subject:from:to:cc :in-reply-to:references:content-type:date:message-id:mime-version :x-mailer:content-transfer-encoding; bh=ZsoCB4vSilzslyoOXaXIp10GXFH9Mpa81ujzl9rDLXQ=; b=sC6Wnt/SeigahrkdfM6LXtXBN3Vo5uy1HTRWwxF8Qh8IiyC8SPGGpBjE1DR2ncsg7h mFGj40ocnoDLfYLDkjnNbR+XgH0b2egjycIaBzgLowL7IpzdkVmc5W2tn3kIj+ZROV6D 89uHQcASqNbE9uYAn/pAWeM4JZEFBouB+SbgM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; b=nEwEEP2MrhYkEG277hh+mTxtSdhDO7JEL95UpD8n9u5JP6ziiu8qD/4qhJUxcl/zdC DmeMEmDO4Ue1agXseCVLCljcs9aSfGAQWkjJupuyEd+GJdBQuwbyrtsVSF5n7OFhGcbS vWzHnUGVcjjlWtZOqlP7qZILzwY04orRh7/k4= Received: by 10.223.23.67 with SMTP id q3mr8137391fab.59.1274906937669; Wed, 26 May 2010 13:48:57 -0700 (PDT) Received: from [127.0.0.1] ([85.17.35.125]) by mx.google.com with ESMTPS id 2sm2128596faf.15.2010.05.26.13.48.54 (version=SSLv3 cipher=RC4-MD5); Wed, 26 May 2010 13:48:56 -0700 (PDT) Subject: RE: NULL Pointer Deference: NFS & Telnet From: Eric Dumazet To: "Arce, Abraham" Cc: David Miller , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "linux-nfs@vger.kernel.org" , "linux-omap@vger.kernel.org" , "tony@atomide.com" , "Shilimkar, Santosh" , "Ha, Tristram" In-Reply-To: <27F9C60D11D683428E133F85D2BB4A53043E3EE6A3@dlee03.ent.ti.com> References: <27F9C60D11D683428E133F85D2BB4A53043E33A997@dlee03.ent.ti.com> <27F9C60D11D683428E133F85D2BB4A53043E3EDFE6@dlee03.ent.ti.com> <20100525.185236.193707791.davem@davemloft.net> <27F9C60D11D683428E133F85D2BB4A53043E3EDFF1@dlee03.ent.ti.com> <1274851741.25136.16.camel@edumazet-laptop> <27F9C60D11D683428E133F85D2BB4A53043E3EE6A3@dlee03.ent.ti.com> Date: Wed, 26 May 2010 22:48:53 +0200 Message-ID: <1274906933.2542.17.camel@edumazet-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Wed, 26 May 2010 20:49:35 +0000 (UTC) diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c index b4fb07a..05bd312 100644 --- a/drivers/net/ks8851.c +++ b/drivers/net/ks8851.c @@ -503,8 +503,9 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE); - if (rxlen > 0) { - skb = netdev_alloc_skb(ks->netdev, rxlen + 2 + 8); + if (rxlen > 4) { + rxlen -= 4; + skb = netdev_alloc_skb(ks->netdev, 2 + 8 + ALIGN(rxlen, 4)); if (!skb) { /* todo - dump frame and move on */ } @@ -513,7 +514,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) * for the status header and 4 bytes of garbage */ skb_reserve(skb, 2 + 4 + 4); - rxpkt = skb_put(skb, rxlen - 4) - 8; + rxpkt = skb_put(skb, rxlen) - 8; /* align the packet length to 4 bytes, and add 4 bytes * as we're getting the rx status header as well */ @@ -526,7 +527,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) netif_rx(skb); ks->netdev->stats.rx_packets++; - ks->netdev->stats.rx_bytes += rxlen - 4; + ks->netdev->stats.rx_bytes += rxlen; } ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);