ne.c 8139too.c to fix CERT VU#412115, 2.4.20

@@ -623,6 +623,7 @@
 		const unsigned char *buf, const int start_page)
 {
 	int nic_base = NE_BASE;
+	int pad_count = count >= ETH_ZLEN ? count : ETH_ZLEN;
 	unsigned long dma_start;
 #ifdef NE_SANITY_CHECK
 	int retries = 0;

@@ -669,16 +670,22 @@
 	outb_p(ENISR_RDC, nic_base + EN0_ISR);
 
 	/* Now the normal output. */
-	outb_p(count & 0xff, nic_base + EN0_RCNTLO);
-	outb_p(count >> 8,   nic_base + EN0_RCNTHI);
+	outb_p(pad_count & 0xff, nic_base + EN0_RCNTLO);
+	outb_p(pad_count >> 8,   nic_base + EN0_RCNTHI);
 	outb_p(0x00, nic_base + EN0_RSARLO);
 	outb_p(start_page, nic_base + EN0_RSARHI);
 
 	outb_p(E8390_RWRITE+E8390_START, nic_base + NE_CMD);
 	if (ei_status.word16) {
 		outsw(NE_BASE + NE_DATAPORT, buf, count>>1);
+		while (count < pad_count) {
+			outw_p(0x00, NE_BASE + NE_DATAPORT);
+			count += 2;
+		}
 	} else {
 		outsb(NE_BASE + NE_DATAPORT, buf, count);
+		while (count++ < pad_count)
+			outb_p(0x00, NE_BASE + NE_DATAPORT);
 	}
 
 	dma_start = jiffies;

@@ -1683,6 +1683,9 @@
 
 	if (likely(len < TX_BUF_SIZE)) {
 		skb_copy_and_csum_dev(skb, tp->tx_buf[entry]);
+		/* PAD the frame out with zeroes */
+		if (len < (unsigned int) ETH_ZLEN)
+			memset(tp->tx_buf[entry] + len, 0, ETH_ZLEN - len);
 		dev_kfree_skb(skb);
 	} else {
 		dev_kfree_skb(skb);