Adrian Bunk wrote:
> The Coverity checker spotted the following two array overflows in
> drivers/net/chelsio/sge.c (in both cases, the arrays contain 3
> elements):
[snip]
This is a bug. The array should contain 2 elements. Here is the fix.
Signed-off-by: Scott Bardone <sbardone@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
if (test_and_clear_bit(nd->if_port,
&sge->stopped_tx_queues) &&
netif_running(nd)) {
if (test_and_clear_bit(nd->if_port,
&sge->stopped_tx_queues) &&
netif_running(nd)) {
- sge->stats.cmdQ_restarted[3]++;
+ sge->stats.cmdQ_restarted[2]++;
netif_wake_queue(nd);
}
}
netif_wake_queue(nd);
}
}
if (unlikely(credits < count)) {
netif_stop_queue(dev);
set_bit(dev->if_port, &sge->stopped_tx_queues);
if (unlikely(credits < count)) {
netif_stop_queue(dev);
set_bit(dev->if_port, &sge->stopped_tx_queues);
- sge->stats.cmdQ_full[3]++;
+ sge->stats.cmdQ_full[2]++;
spin_unlock(&q->lock);
if (!netif_queue_stopped(dev))
CH_ERR("%s: Tx ring full while queue awake!\n",
spin_unlock(&q->lock);
if (!netif_queue_stopped(dev))
CH_ERR("%s: Tx ring full while queue awake!\n",
return NETDEV_TX_BUSY;
}
if (unlikely(credits - count < q->stop_thres)) {
return NETDEV_TX_BUSY;
}
if (unlikely(credits - count < q->stop_thres)) {
- sge->stats.cmdQ_full[3]++;
+ sge->stats.cmdQ_full[2]++;
netif_stop_queue(dev);
set_bit(dev->if_port, &sge->stopped_tx_queues);
}
netif_stop_queue(dev);
set_bit(dev->if_port, &sge->stopped_tx_queues);
}