[patch] 2.4.26-pre1 - drivers/net/r8169.c

[Francois Romieu <romieu@fr.zoreil.com>]

[-- Attachment #1: Type: text/plain, Size: 407 bytes --]

Marcelo Tosatti <marcelo.tosatti@cyclades.com> :
[...]
> Here goes -pre1.

Please apply attached patch.

Without patch, bogus descriptors are parsed as soon as
tp->cur_tx%NUM_TX_DESC + (tp->cur_tx - tp->dirty_tx) > NUM_TX_DESC
(assume for instance tp->dirty_tx = NUM_TX_DESC/2,
tp->cur_tx = NUM_TX_DESC - 1 and watch entry go beyond NUM_TX_DESC).

Missing stats update is fixed by the patch btw.

--
Ueimor

[-- Attachment #2: r8169-tx-desc-overflow.patch --]
[-- Type: text/plain, Size: 955 bytes --]

--- drivers/net/r8169.c.orig	2004-02-25 23:34:15.000000000 +0100
+++ drivers/net/r8169.c	2004-02-25 23:47:26.000000000 +0100
@@ -874,7 +874,6 @@ rtl8169_tx_interrupt(struct net_device *
 		     void *ioaddr)
 {
 	unsigned long dirty_tx, tx_left = 0;
-	int entry = tp->cur_tx % NUM_TX_DESC;
 
 	assert(dev != NULL);
 	assert(tp != NULL);
@@ -884,14 +883,18 @@ rtl8169_tx_interrupt(struct net_device *
 	tx_left = tp->cur_tx - dirty_tx;
 
 	while (tx_left > 0) {
+		int entry = dirty_tx % NUM_TX_DESC;
+
 		if ((tp->TxDescArray[entry].status & OWNbit) == 0) {
-			dev_kfree_skb_irq(tp->
-					  Tx_skbuff[dirty_tx % NUM_TX_DESC]);
-			tp->Tx_skbuff[dirty_tx % NUM_TX_DESC] = NULL;
+			struct sk_buff *skb = tp->Tx_skbuff[entry];
+
+			tp->stats.tx_bytes += skb->len >= ETH_ZLEN ?
+					      skb->len : ETH_ZLEN;
 			tp->stats.tx_packets++;
+			dev_kfree_skb_irq(skb);
+			tp->Tx_skbuff[entry] = NULL;
 			dirty_tx++;
 			tx_left--;
-			entry++;
 		}
 	}