Skip to contentSkip to conversation

beyond ARRAY_SIZE of ib->btx_ring

PATCH Applied Roel Kluin 2 participants 2 messages Feb 22, 2009

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 beyond ARRAY_SIZE of ib->btx_ring

// vi drivers/net/sunlance.c +216
struct lance_init_block {
...

        struct lance_tx_desc btx_ring[TX_RING_SIZE];

...
};
This is a bug, isn't it? --------------------------->8-------------8<------------------------------ Do not go beyond ARRAY_SIZE of ib->btx_ring

Signed-off-by Roel Kluin <[email protected]>

---

drivers/net/sunlance.c +2 -2
index 2813732..16c528d 100644
@@ -343,7 +343,7 @@ static void lance_init_ring_dvma(struct net_device *dev)
 	ib->phys_addr [5] = dev->dev_addr [4];
 
 	/* Setup the Tx ring entries */
-	for (i = 0; i <= TX_RING_SIZE; i++) {
+	for (i = 0; i < TX_RING_SIZE; i++) {
 		leptr = LANCE_ADDR(aib + libbuff_offset(tx_buf, i));
 		ib->btx_ring [i].tmd0      = leptr;
 		ib->btx_ring [i].tmd1_hadr = leptr >> 16;

@@ -399,7 +399,7 @@ static void lance_init_ring_pio(struct net_device *dev)
 	sbus_writeb(dev->dev_addr[4], &ib->phys_addr[5]);
 
 	/* Setup the Tx ring entries */
-	for (i = 0; i <= TX_RING_SIZE; i++) {
+	for (i = 0; i < TX_RING_SIZE; i++) {
 		leptr = libbuff_offset(tx_buf, i);
 		sbus_writew(leptr,	&ib->btx_ring [i].tmd0);
 		sbus_writeb(leptr >> 16,&ib->btx_ring [i].tmd1_hadr);
maintainer Applied
#1 lore raw

From: Roel Kluin <[email protected]>
Date: Sun, 22 Feb 2009 02:40:45 +0100

Quoted 7 lines

// vi drivers/net/sunlance.c +216
struct lance_init_block {
...

        struct lance_tx_desc btx_ring[TX_RING_SIZE];

...
};
This is a bug, isn't it?

Yep, luckily this is harmless since it just puts a turd into the TX buffers.

Quoted 3 lines

Do not go beyond ARRAY_SIZE of ib->btx_ring

Signed-off-by Roel Kluin <[email protected]>

Applied, thanks.