Poss. bug in tulip driver since 2.4.7

From: Prasanna Meda (pmeda_at_akamai.com)
Date: 11/12/03

  • Next message: Andi Kleen: "Re: 2 TB partition support" 
    Date:	Tue, 11 Nov 2003 16:47:40 -0800
To: tulip-users@lists.sourceforge.net, linux-kernel@vger.kernel.org

    The inner for loop shown below was not
    supposed to be inside the outside loop.
    They also use the same index i.
    Due to this, when mc_count is more than
    14, with non ASIX chips, panics, corruptions
    and denial of services to multicast addresses
    can result!

    http://lxr.linux.no/source/drivers/net/tulip/tulip_core.c#L1055

    static void build_setup_frame_hash(u16 *setup_frm, struct net_device
    *dev)
    {
            struct tulip_private *tp = (struct tulip_private *)dev->priv;
            u16 hash_table[32];
            struct dev_mc_list *mclist;
            int i;
            u16 *eaddrs;

            memset(hash_table, 0, sizeof(hash_table));
            set_bit_le(255, hash_table); /* Broadcast
    entry */
            /* This should work on big-endian machines as well. */
            for (i = 0, mclist = dev->mc_list; mclist && i < dev->mc_count;
                 i++, mclist = mclist->next) {
                    int index = ether_crc_le(ETH_ALEN, mclist->dmi_addr) &
    0x1ff;

                    set_bit_le(index, hash_table);

                    for (i = 0; i < 32; i++) {
                            *setup_frm++ = hash_table[i];
                            *setup_frm++ = hash_table[i];
                    }
                    setup_frm = &tp->setup_frame[13*6];
            }

            /* Fill the final entry with our physical address. */
            eaddrs = (u16 *)dev->dev_addr;
            *setup_frm++ = eaddrs[0]; *setup_frm++ = eaddrs[0];
            *setup_frm++ = eaddrs[1]; *setup_frm++ = eaddrs[1];
            *setup_frm++ = eaddrs[2]; *setup_frm++ = eaddrs[2];
    }

    Thanks,
    Prasanna.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

  • Next message: Andi Kleen: "Re: 2 TB partition support"

    Relevant Pages

    • Re: Help port swsusp to ppc.
      ... > to the suspend image with those informations and the page copy loop ... send the line "unsubscribe linux-kernel" in ... More majordomo info at http://vger.kernel.org/majordomo-info.html ...
      (Linux-Kernel)
    • wait_event and preemption in 2.6
      ... I'm writing a device driver for PPC Linux and I'm using wait_event. ... preemption is turned on. ... check the condition and break out of the loop. ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • [PATCH] NULL pointer deref in tcp_do_twkill_work()
      ... Shouldn't the loop always restart from the beginning instead of using the ... The alternative is to not drop the lock, but I'm guessing we need to do ... Proposed patch is attached. ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • x86 build issue with software suspend code
      ... collision and the relocation from and alloc section targeting targeting ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • Re: [PATCH 2.6.9-rc2-mm1 0/2] mm: memory policy for page cache allocation
      ... Patches done with the 'diff -p' option are slightly easier to ... Could you explain the for loop in alloc_page_roundrobin? ... pseudo-uniform distribution, without any need for the additional rr_next ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)