From 4c537e6371a9510c82eb96fb7e1e66017e0e2053 Mon Sep 17 00:00:00 2001 From: Jon Smirl Date: Mon, 3 Dec 2007 22:38:10 +0000 Subject: Fix memory corruption in fec_mpc52xx The mpc5200 fec driver is corrupting memory. This patch fixes two bugs where the wrong skb was being referenced. Signed-off-by: Jon Smirl Acked-by: Domen Puncer Signed-off-by: Grant Likely Signed-off-by: David Woodhouse Signed-off-by: Jeff Garzik --- drivers/net/fec_mpc52xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/net') diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c index bf5a7caa5b5..79f7eade477 100644 --- a/drivers/net/fec_mpc52xx.c +++ b/drivers/net/fec_mpc52xx.c @@ -422,7 +422,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id) rskb = bcom_retrieve_buffer(priv->rx_dmatsk, &status, (struct bcom_bd **)&bd); - dma_unmap_single(&dev->dev, bd->skb_pa, skb->len, DMA_FROM_DEVICE); + dma_unmap_single(&dev->dev, bd->skb_pa, rskb->len, DMA_FROM_DEVICE); /* Test for errors in received frame */ if (status & BCOM_FEC_RX_BD_ERRORS) { @@ -467,7 +467,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id) bcom_prepare_next_buffer(priv->rx_dmatsk); bd->status = FEC_RX_BUFFER_SIZE; - bd->skb_pa = dma_map_single(&dev->dev, rskb->data, + bd->skb_pa = dma_map_single(&dev->dev, skb->data, FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE); bcom_submit_next_buffer(priv->rx_dmatsk, skb); -- cgit v1.2.3