Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
[PATCH] dl2k: DMA freeing error
This patch fixes an error in the dl2k driver's DMA mapping/unmapping.
The adapter uses the upper 16bits of the DMA address for the buffer
size. However, this is not masked off when referencing the DMA
address, and can lead to errors by trying to free a DMA address out of
range.
Thanks,
Jon
Signed-off-by: Jon Mason <jdmason@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
authored by
Jon Mason
and committed by
Jeff Garzik
9ee09d9c
9e927fb6
+15
-10
+15
-10
drivers/net/dl2k.c
+15
-10
drivers/net/dl2k.c
···
50
50
51
51
*/
52
52
#define DRV_NAME "D-Link DL2000-based linux driver"
53
-
#define DRV_VERSION "v1.17a"
54
-
#define DRV_RELDATE "2002/10/04"
53
+
#define DRV_VERSION "v1.17b"
54
+
#define DRV_RELDATE "2006/03/10"
55
55
#include "dl2k.h"
56
56
57
57
static char version[] __devinitdata =
···
765
765
break;
766
766
skb = np->tx_skbuff[entry];
767
767
pci_unmap_single (np->pdev,
768
-
np->tx_ring[entry].fraginfo,
768
+
np->tx_ring[entry].fraginfo & 0xffffffffffff,
769
769
skb->len, PCI_DMA_TODEVICE);
770
770
if (irq)
771
771
dev_kfree_skb_irq (skb);
···
892
892
893
893
/* Small skbuffs for short packets */
894
894
if (pkt_len > copy_thresh) {
895
-
pci_unmap_single (np->pdev, desc->fraginfo,
895
+
pci_unmap_single (np->pdev,
896
+
desc->fraginfo & 0xffffffffffff,
896
897
np->rx_buf_sz,
897
898
PCI_DMA_FROMDEVICE);
898
899
skb_put (skb = np->rx_skbuff[entry], pkt_len);
899
900
np->rx_skbuff[entry] = NULL;
900
901
} else if ((skb = dev_alloc_skb (pkt_len + 2)) != NULL) {
901
902
pci_dma_sync_single_for_cpu(np->pdev,
902
-
desc->fraginfo,
903
+
desc->fraginfo &
904
+
0xffffffffffff,
903
905
np->rx_buf_sz,
904
906
PCI_DMA_FROMDEVICE);
905
907
skb->dev = dev;
···
912
910
pkt_len, 0);
913
911
skb_put (skb, pkt_len);
914
912
pci_dma_sync_single_for_device(np->pdev,
915
-
desc->fraginfo,
913
+
desc->fraginfo &
914
+
0xffffffffffff,
916
915
np->rx_buf_sz,
917
916
PCI_DMA_FROMDEVICE);
918
917
}
···
1799
1796
np->rx_ring[i].fraginfo = 0;
1800
1797
skb = np->rx_skbuff[i];
1801
1798
if (skb) {
1802
-
pci_unmap_single (np->pdev, np->rx_ring[i].fraginfo,
1803
-
skb->len, PCI_DMA_FROMDEVICE);
1799
+
pci_unmap_single(np->pdev,
1800
+
np->rx_ring[i].fraginfo & 0xffffffffffff,
1801
+
skb->len, PCI_DMA_FROMDEVICE);
1804
1802
dev_kfree_skb (skb);
1805
1803
np->rx_skbuff[i] = NULL;
1806
1804
}
···
1809
1805
for (i = 0; i < TX_RING_SIZE; i++) {
1810
1806
skb = np->tx_skbuff[i];
1811
1807
if (skb) {
1812
-
pci_unmap_single (np->pdev, np->tx_ring[i].fraginfo,
1813
-
skb->len, PCI_DMA_TODEVICE);
1808
+
pci_unmap_single(np->pdev,
1809
+
np->tx_ring[i].fraginfo & 0xffffffffffff,
1810
+
skb->len, PCI_DMA_TODEVICE);
1814
1811
dev_kfree_skb (skb);
1815
1812
np->tx_skbuff[i] = NULL;
1816
1813
}