2003-01-10 18:28:26

by Rudmer van Dijk

Subject: [PATCH] 2.5.55 fix etherleak in 8390.c [rescued]

this is the fix which went in 2.4.21-pre3-ac2, rediffed against 2.5.55

Rudmer

--- linux-2.5.55/drivers/net/8390.c.orig 2003-01-10 16:23:44.000000000 +0100
+++ linux-2.5.55/drivers/net/8390.c 2003-01-10 16:23:00.000000000 +0100
@@ -270,6 +270,7 @@
struct ei_device *ei_local = (struct ei_device *) dev->priv;
int length, send_length, output_page;
unsigned long flags;
+ char scratch[ETH_ZLEN];

length = skb->len;

@@ -341,7 +342,15 @@
* trigger the send later, upon receiving a Tx done interrupt.
*/

- ei_block_output(dev, length, skb->data, output_page);
+ if (length == send_length)
+ ei_block_output(dev, length, skb->data, output_page);
+ else
+ {
+ memset(scratch, 0, ETH_ZLEN);
+ memcpy(scratch, skb->data, skb->len);
+ ei_block_output(dev, ETH_ZLEN, scratch, output_page);
+ }
+
if (! ei_local->txing)
{
ei_local->txing = 1;
@@ -373,7 +382,14 @@
* reasonable hardware if you only use one Tx buffer.
*/

- ei_block_output(dev, length, skb->data, ei_local->tx_start_page);
+ if(length == send_length)
+ ei_block_output(dev, length, skb->data, ei_local->tx_start_page);
+ else
+ {
+ memset(scratch, 0, ETH_ZLEN);
+ memcpy(scratch, skb->data, skb->len);
+ ei_block_output(dev, ETH_ZLEN, scratch, ei_local->tx_start_page);
+ }
ei_local->txing = 1;
NS8390_trigger_send(dev, send_length, ei_local->tx_start_page);
dev->trans_start = jiffies;

2003-01-10 19:17:06

by Matti Aarnio

Subject: Re: [PATCH] 2.5.55 fix etherleak in 8390.c [rescued]

On Fri, Jan 10, 2003 at 07:35:10PM +0100, Rudmer van Dijk wrote:
> this is the fix which went in 2.4.21-pre3-ac2, rediffed against 2.5.55
> Rudmer

That scratch[] allocation is 60 bytes, taken off the stack.
It isn't very large, and isn't recursive, but still...

> --- linux-2.5.55/drivers/net/8390.c.orig 2003-01-10 16:23:44.000000000 +0100
> +++ linux-2.5.55/drivers/net/8390.c 2003-01-10 16:23:00.000000000 +0100
> @@ -270,6 +270,7 @@
> struct ei_device *ei_local = (struct ei_device *) dev->priv;
> int length, send_length, output_page;
> unsigned long flags;
> + char scratch[ETH_ZLEN];
>
> length = skb->len;


/Matti Aarnio