瀏覽代碼

Fix some bad pointer arithmatic in the tg3 driver that was causing the dynamic memory pool to be corrupted (or worse)

tags/v0.9.3
James Harper 18 年之前
父節點
當前提交
e1735d5fc2
共有 1 個檔案被更改,包括 6 行新增6 行删除
  1. 6
    6
      src/drivers/net/tg3.c

+ 6
- 6
src/drivers/net/tg3.c 查看文件

3167
 	
3167
 	
3168
 	/* Copy the packet to the our local buffer */
3168
 	/* Copy the packet to the our local buffer */
3169
 	frame = &tg3_bss.tx_frame[frame_idx];
3169
 	frame = &tg3_bss.tx_frame[frame_idx];
3170
-	memcpy(frame[frame_idx].dst_addr, dst_addr, ETH_ALEN);
3171
-	memcpy(frame[frame_idx].src_addr, nic->node_addr, ETH_ALEN);
3172
-	frame[frame_idx].type = htons(type);
3173
-	memset(frame[frame_idx].data, 0, sizeof(frame[frame_idx].data));
3174
-	memcpy(frame[frame_idx].data, packet, size);
3170
+	memcpy(frame->dst_addr, dst_addr, ETH_ALEN);
3171
+	memcpy(frame->src_addr, nic->node_addr, ETH_ALEN);
3172
+	frame->type = htons(type);
3173
+	memset(frame->data, 0, sizeof(frame->data));
3174
+	memcpy(frame->data, packet, size);
3175
 
3175
 
3176
 	/* Setup the ring buffer entry to transmit */
3176
 	/* Setup the ring buffer entry to transmit */
3177
 	txd            = &tp->tx_ring[entry];
3177
 	txd            = &tp->tx_ring[entry];
3178
 	txd->addr_hi   = 0; /* Etherboot runs under 4GB */
3178
 	txd->addr_hi   = 0; /* Etherboot runs under 4GB */
3179
-	txd->addr_lo   = virt_to_bus(&frame[frame_idx]);
3179
+	txd->addr_lo   = virt_to_bus(frame);
3180
 	txd->len_flags = ((size + ETH_HLEN) << TXD_LEN_SHIFT) | TXD_FLAG_END;
3180
 	txd->len_flags = ((size + ETH_HLEN) << TXD_LEN_SHIFT) | TXD_FLAG_END;
3181
 	txd->vlan_tag  = 0 << TXD_VLAN_TAG_SHIFT;
3181
 	txd->vlan_tag  = 0 << TXD_VLAN_TAG_SHIFT;
3182
 
3182
 

Loading…
取消
儲存