From: Scott Bardone Date: Fri, 17 Mar 2006 00:20:40 +0000 (-0500) Subject: [netdrvr] fix array overflows in Chelsio driver X-Git-Tag: v2.6.16~20 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=232a347a444e687b5f8cf0f6485704db1c6024d3;p=linux-2.6-omap-h63xx.git [netdrvr] fix array overflows in Chelsio driver Adrian Bunk wrote: > The Coverity checker spotted the following two array overflows in > drivers/net/chelsio/sge.c (in both cases, the arrays contain 3 > elements): [snip] This is a bug. The array should contain 2 elements. Here is the fix. Signed-off-by: Scott Bardone Signed-off-by: Jeff Garzik --- diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c index 2c5b849b7ba..30ff8ea1a40 100644 --- a/drivers/net/chelsio/sge.c +++ b/drivers/net/chelsio/sge.c @@ -1021,7 +1021,7 @@ static void restart_tx_queues(struct sge *sge) if (test_and_clear_bit(nd->if_port, &sge->stopped_tx_queues) && netif_running(nd)) { - sge->stats.cmdQ_restarted[3]++; + sge->stats.cmdQ_restarted[2]++; netif_wake_queue(nd); } } @@ -1350,7 +1350,7 @@ static int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter, if (unlikely(credits < count)) { netif_stop_queue(dev); set_bit(dev->if_port, &sge->stopped_tx_queues); - sge->stats.cmdQ_full[3]++; + sge->stats.cmdQ_full[2]++; spin_unlock(&q->lock); if (!netif_queue_stopped(dev)) CH_ERR("%s: Tx ring full while queue awake!\n", @@ -1358,7 +1358,7 @@ static int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter, return NETDEV_TX_BUSY; } if (unlikely(credits - count < q->stop_thres)) { - sge->stats.cmdQ_full[3]++; + sge->stats.cmdQ_full[2]++; netif_stop_queue(dev); set_bit(dev->if_port, &sge->stopped_tx_queues); }