From: Felix Fietkau <nbd@openwrt.org>
Date: Sat, 10 Jan 2009 00:55:38 +0000 (+0000)
Subject: fix a memory corruption bug in the linux 2.4 version of b44
X-Git-Url: http://git.openwrt.org/?p=openwrt%2Fsvn-archive%2Farchive.git;a=commitdiff_plain;hb=1e321663ca5c292bc6e96e9b15b808688a37d8c8

fix a memory corruption bug in the linux 2.4 version of b44

SVN-Revision: 13955
---

diff --git a/target/linux/brcm-2.4/patches/110-b44_alignment.patch b/target/linux/brcm-2.4/patches/110-b44_alignment.patch
index c1f078234a..1f6e975b8d 100644
--- a/target/linux/brcm-2.4/patches/110-b44_alignment.patch
+++ b/target/linux/brcm-2.4/patches/110-b44_alignment.patch
@@ -10,19 +10,19 @@
  
  /* minimum number of free TX descriptors required to wake up TX process */
  #define B44_TX_WAKEUP_THRESH		(B44_TX_RING_SIZE / 4)
-@@ -734,10 +735,9 @@ static int b44_alloc_rx_skb(struct b44 *
+@@ -734,10 +735,8 @@ static int b44_alloc_rx_skb(struct b44 *
  	mapping = pci_map_single(bp->pdev, skb->data,
  				 RX_PKT_BUF_SZ,
  				 PCI_DMA_FROMDEVICE);
 -	skb_reserve(skb, bp->rx_offset);
  
- 	rh = (struct rx_header *)
+-	rh = (struct rx_header *)
 -		(skb->data - bp->rx_offset);
-+		(skb->data - RX_HEADER_OFS);
++	rh = (struct rx_header *) skb->data;
  	rh->len = 0;
  	rh->flags = 0;
  
-@@ -747,13 +747,13 @@ static int b44_alloc_rx_skb(struct b44 *
+@@ -747,13 +746,13 @@ static int b44_alloc_rx_skb(struct b44 *
  	if (src_map != NULL)
  		src_map->skb = NULL;
  
@@ -38,7 +38,7 @@
  
  	return RX_PKT_BUF_SZ;
  }
-@@ -812,7 +812,7 @@ static int b44_rx(struct b44 *bp, int bu
+@@ -812,7 +811,7 @@ static int b44_rx(struct b44 *bp, int bu
  				    PCI_DMA_FROMDEVICE);
  		rh = (struct rx_header *) skb->data;
  		len = cpu_to_le16(rh->len);
@@ -47,7 +47,7 @@
  		    (rh->flags & cpu_to_le16(RX_FLAG_ERRORS))) {
  		drop_it:
  			b44_recycle_rx(bp, cons, bp->rx_prod);
-@@ -844,8 +844,8 @@ static int b44_rx(struct b44 *bp, int bu
+@@ -844,8 +843,8 @@ static int b44_rx(struct b44 *bp, int bu
  			pci_unmap_single(bp->pdev, map,
  					 skb_size, PCI_DMA_FROMDEVICE);
  			/* Leave out rx_header */
@@ -58,7 +58,7 @@
  		} else {
  			struct sk_buff *copy_skb;
  
-@@ -858,7 +858,7 @@ static int b44_rx(struct b44 *bp, int bu
+@@ -858,7 +857,7 @@ static int b44_rx(struct b44 *bp, int bu
  			skb_reserve(copy_skb, 2);
  			skb_put(copy_skb, len);
  			/* DMA sync done above, copy just the actual packet */
@@ -67,7 +67,7 @@
  
  			skb = copy_skb;
  		}
-@@ -1344,7 +1344,7 @@ static void b44_init_hw(struct b44 *bp)
+@@ -1344,7 +1343,7 @@ static void b44_init_hw(struct b44 *bp)
  	bw32(B44_DMATX_CTRL, DMATX_CTRL_ENABLE);
  	bw32(B44_DMATX_ADDR, bp->tx_ring_dma + bp->dma_offset);
  	bw32(B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
@@ -76,7 +76,7 @@
  	bw32(B44_DMARX_ADDR, bp->rx_ring_dma + bp->dma_offset);
  
  	bw32(B44_DMARX_PTR, bp->rx_pending);
-@@ -1873,13 +1873,7 @@ static int __devinit b44_get_invariants(
+@@ -1873,13 +1872,7 @@ static int __devinit b44_get_invariants(
  		bp->mdc_port = (eeprom[90] >> 14) & 0x1;
  	}