lkml.org 
[lkml]   [2005]   [Dec]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] forcedeth: fix random memory scribbling bug


On Sat, 24 Dec 2005, Manfred Spraul wrote:
>
> Two critical bugs were found in forcedeth 0.47:
> - TSO doesn't work.
> - pci_map_single() for the rx buffers is called with size==0. This bug is
> critical, it causes random memory corruptions on systems with an iommu.

Good catch. Btw, should we perhaps disallow (or at least WARN_ON())
pci_map_single() with a length of zero? I think it's always likely a bug..

However, that

"skb->end - skb->data"

calculation is a bit strange. It correctly maps the whole skb, but
wouldn't it make more sense to use the length we actually tell the card to
use?

In other words, wouldn't it be a whole lot more sensible and logical to
use

np->rx_buf_sz

instead? That's the value we use for allocation and that's the size we
tell the card we have.

Of course, on the alloc path, it seems to add an additional
"NV_RX_ALLOC_PAD" thing, so maybe the "end-data" thing makes sense.

Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2009-11-18 23:46    [W:0.261 / U:1.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site