Browse Source

Fix some bad pointer arithmatic in the tg3 driver that was causing the dynamic memory pool to be corrupted (or worse)

tags/v0.9.3
James Harper 18 years ago
parent
commit
e1735d5fc2
1 changed files with 6 additions and 6 deletions
  1. 6
    6
      src/drivers/net/tg3.c

+ 6
- 6
src/drivers/net/tg3.c View File

3167
 	
3167
 	
3168
 	/* Copy the packet to the our local buffer */
3168
 	/* Copy the packet to the our local buffer */
3169
 	frame = &tg3_bss.tx_frame[frame_idx];
3169
 	frame = &tg3_bss.tx_frame[frame_idx];
3170
-	memcpy(frame[frame_idx].dst_addr, dst_addr, ETH_ALEN);
3171
-	memcpy(frame[frame_idx].src_addr, nic->node_addr, ETH_ALEN);
3172
-	frame[frame_idx].type = htons(type);
3173
-	memset(frame[frame_idx].data, 0, sizeof(frame[frame_idx].data));
3174
-	memcpy(frame[frame_idx].data, packet, size);
3170
+	memcpy(frame->dst_addr, dst_addr, ETH_ALEN);
3171
+	memcpy(frame->src_addr, nic->node_addr, ETH_ALEN);
3172
+	frame->type = htons(type);
3173
+	memset(frame->data, 0, sizeof(frame->data));
3174
+	memcpy(frame->data, packet, size);
3175
 
3175
 
3176
 	/* Setup the ring buffer entry to transmit */
3176
 	/* Setup the ring buffer entry to transmit */
3177
 	txd            = &tp->tx_ring[entry];
3177
 	txd            = &tp->tx_ring[entry];
3178
 	txd->addr_hi   = 0; /* Etherboot runs under 4GB */
3178
 	txd->addr_hi   = 0; /* Etherboot runs under 4GB */
3179
-	txd->addr_lo   = virt_to_bus(&frame[frame_idx]);
3179
+	txd->addr_lo   = virt_to_bus(frame);
3180
 	txd->len_flags = ((size + ETH_HLEN) << TXD_LEN_SHIFT) | TXD_FLAG_END;
3180
 	txd->len_flags = ((size + ETH_HLEN) << TXD_LEN_SHIFT) | TXD_FLAG_END;
3181
 	txd->vlan_tag  = 0 << TXD_VLAN_TAG_SHIFT;
3181
 	txd->vlan_tag  = 0 << TXD_VLAN_TAG_SHIFT;
3182
 
3182
 

Loading…
Cancel
Save