On Thu, 2007-03-29 at 22:47 +0000, Cureington, Tony wrote:
> A buffer overrun issue exists in the bnx2_nvram_write function.
Tony, thanks for the patch. The alignment logic is indeed still broken
despite trying to fix it before. I think the following patch is better
in fixing the alignment logic. I agree with you about moving the code
to erase the page, and that part of your patch is preserved.
[BNX2]: Fix nvram write logic.
The nvram dword alignment logic was broken when writing less than 4
bytes on a non-aligned offset. It was missing logic to round the
length to 4 bytes.
The page erase code is also moved so that it is only called when
using non-buffered flash for better code clarity.
Update version to 1.5.7.
Based on initial patch from Tony Cureington <[EMAIL PROTECTED]>.
Signed-off-by: Michael Chan <[EMAIL PROTECTED]>
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d43fe28..0b7aded 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
#define DRV_MODULE_NAME "bnx2"
#define PFX DRV_MODULE_NAME ": "
-#define DRV_MODULE_VERSION "1.5.6"
-#define DRV_MODULE_RELDATE "March 28, 2007"
+#define DRV_MODULE_VERSION "1.5.7"
+#define DRV_MODULE_RELDATE "March 29, 2007"
#define RUN_AT(x) (jiffies + (x))
@@ -3099,20 +3099,18 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8
*data_buf,
if ((align_start = (offset32 & 3))) {
offset32 &= ~3;
- len32 += (4 - align_start);
+ len32 += align_start;
+ if (len32 < 4)
+ len32 = 4;
if ((rc = bnx2_nvram_read(bp, offset32, start, 4)))
return rc;
}
if (len32 & 3) {
- if ((len32 > 4) || !align_start) {
- align_end = 4 - (len32 & 3);
- len32 += align_end;
- if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4,
- end, 4))) {
- return rc;
- }
- }
+ align_end = 4 - (len32 & 3);
+ len32 += align_end;
+ if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4, end, 4)))
+ return rc;
}
if (align_start || align_end) {
@@ -3187,17 +3185,17 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8
*data_buf,
if ((rc = bnx2_enable_nvram_write(bp)) != 0)
goto nvram_write_end;
- /* Erase the page */
- if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
- goto nvram_write_end;
-
- /* Re-enable the write again for the actual write */
- bnx2_enable_nvram_write(bp);
-
/* Loop to write back the buffer data from page_start to
* data_start */
i = 0;
if (bp->flash_info->buffered == 0) {
+ /* Erase the page */
+ if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
+ goto nvram_write_end;
+
+ /* Re-enable the write again for the actual write */
+ bnx2_enable_nvram_write(bp);
+
for (addr = page_start; addr < data_start;
addr += 4, i += 4) {
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
