iwmc3200wifi: fix array out-of-boundary access
[pandora-kernel.git] / drivers / net / e1000 / e1000_main.c
index 6a61414..7e855f9 100644 (file)
@@ -1839,10 +1839,17 @@ void e1000_free_all_tx_resources(struct e1000_adapter *adapter)
 static void e1000_unmap_and_free_tx_resource(struct e1000_adapter *adapter,
                                             struct e1000_buffer *buffer_info)
 {
-       buffer_info->dma = 0;
+       if (buffer_info->dma) {
+               if (buffer_info->mapped_as_page)
+                       pci_unmap_page(adapter->pdev, buffer_info->dma,
+                                      buffer_info->length, PCI_DMA_TODEVICE);
+               else
+                       pci_unmap_single(adapter->pdev, buffer_info->dma,
+                                        buffer_info->length,
+                                        PCI_DMA_TODEVICE);
+               buffer_info->dma = 0;
+       }
        if (buffer_info->skb) {
-               skb_dma_unmap(&adapter->pdev->dev, buffer_info->skb,
-                             DMA_TO_DEVICE);
                dev_kfree_skb_any(buffer_info->skb);
                buffer_info->skb = NULL;
        }
@@ -2683,22 +2690,14 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                        unsigned int mss)
 {
        struct e1000_hw *hw = &adapter->hw;
+       struct pci_dev *pdev = adapter->pdev;
        struct e1000_buffer *buffer_info;
        unsigned int len = skb_headlen(skb);
-       unsigned int offset, size, count = 0, i;
+       unsigned int offset = 0, size, count = 0, i;
        unsigned int f;
-       dma_addr_t *map;
 
        i = tx_ring->next_to_use;
 
-       if (skb_dma_map(&adapter->pdev->dev, skb, DMA_TO_DEVICE)) {
-               dev_err(&adapter->pdev->dev, "TX DMA map failed\n");
-               return 0;
-       }
-
-       map = skb_shinfo(skb)->dma_maps;
-       offset = 0;
-
        while (len) {
                buffer_info = &tx_ring->buffer_info[i];
                size = min(len, max_per_txd);
@@ -2735,7 +2734,11 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                buffer_info->length = size;
                /* set time_stamp *before* dma to help avoid a possible race */
                buffer_info->time_stamp = jiffies;
-               buffer_info->dma = skb_shinfo(skb)->dma_head + offset;
+               buffer_info->mapped_as_page = false;
+               buffer_info->dma = pci_map_single(pdev, skb->data + offset,
+                                                 size, PCI_DMA_TODEVICE);
+               if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                       goto dma_error;
                buffer_info->next_to_watch = i;
 
                len -= size;
@@ -2753,7 +2756,7 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
 
                frag = &skb_shinfo(skb)->frags[f];
                len = frag->size;
-               offset = 0;
+               offset = frag->page_offset;
 
                while (len) {
                        i++;
@@ -2777,7 +2780,12 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
 
                        buffer_info->length = size;
                        buffer_info->time_stamp = jiffies;
-                       buffer_info->dma = map[f] + offset;
+                       buffer_info->mapped_as_page = true;
+                       buffer_info->dma = pci_map_page(pdev, frag->page,
+                                                       offset, size,
+                                                       PCI_DMA_TODEVICE);
+                       if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                               goto dma_error;
                        buffer_info->next_to_watch = i;
 
                        len -= size;
@@ -2790,6 +2798,22 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
        tx_ring->buffer_info[first].next_to_watch = i;
 
        return count;
+
+dma_error:
+       dev_err(&pdev->dev, "TX DMA map failed\n");
+       buffer_info->dma = 0;
+       count--;
+
+       while (count >= 0) {
+               count--;
+               i--;
+               if (i < 0)
+                       i += tx_ring->count;
+               buffer_info = &tx_ring->buffer_info[i];
+               e1000_unmap_and_free_tx_resource(adapter, buffer_info);
+       }
+
+       return 0;
 }
 
 static void e1000_tx_queue(struct e1000_adapter *adapter,
@@ -3483,8 +3507,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
                adapter->detect_tx_hung = false;
                if (tx_ring->buffer_info[eop].time_stamp &&
                    time_after(jiffies, tx_ring->buffer_info[eop].time_stamp +
-                              (adapter->tx_timeout_factor * HZ))
-                   && !(er32(STATUS) & E1000_STATUS_TXOFF)) {
+                              (adapter->tx_timeout_factor * HZ)) &&
+                   !(er32(STATUS) & E1000_STATUS_TXOFF)) {
 
                        /* detected Tx unit hang */
                        DPRINTK(DRV, ERR, "Detected Tx Unit Hang\n"
@@ -3866,9 +3890,8 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                 * of reassembly being done in the stack */
                if (length < copybreak) {
                        struct sk_buff *new_skb =
-                           netdev_alloc_skb(netdev, length + NET_IP_ALIGN);
+                           netdev_alloc_skb_ip_align(netdev, length);
                        if (new_skb) {
-                               skb_reserve(new_skb, NET_IP_ALIGN);
                                skb_copy_to_linear_data_offset(new_skb,
                                                               -NET_IP_ALIGN,
                                                               (skb->data -
@@ -3937,9 +3960,7 @@ e1000_alloc_jumbo_rx_buffers(struct e1000_adapter *adapter,
        struct e1000_buffer *buffer_info;
        struct sk_buff *skb;
        unsigned int i;
-       unsigned int bufsz = 256 -
-                            16 /*for skb_reserve */ -
-                            NET_IP_ALIGN;
+       unsigned int bufsz = 256 - 16 /*for skb_reserve */ ;
 
        i = rx_ring->next_to_use;
        buffer_info = &rx_ring->buffer_info[i];
@@ -3951,7 +3972,7 @@ e1000_alloc_jumbo_rx_buffers(struct e1000_adapter *adapter,
                        goto check_page;
                }
 
-               skb = netdev_alloc_skb(netdev, bufsz);
+               skb = netdev_alloc_skb_ip_align(netdev, bufsz);
                if (unlikely(!skb)) {
                        /* Better luck next round */
                        adapter->alloc_rx_buff_failed++;
@@ -3964,7 +3985,7 @@ e1000_alloc_jumbo_rx_buffers(struct e1000_adapter *adapter,
                        DPRINTK(PROBE, ERR, "skb align check failed: %u bytes "
                                             "at %p\n", bufsz, skb->data);
                        /* Try again, without freeing the previous */
-                       skb = netdev_alloc_skb(netdev, bufsz);
+                       skb = netdev_alloc_skb_ip_align(netdev, bufsz);
                        /* Failed allocation, critical failure */
                        if (!skb) {
                                dev_kfree_skb(oldskb);
@@ -3982,12 +4003,6 @@ e1000_alloc_jumbo_rx_buffers(struct e1000_adapter *adapter,
                        /* Use new allocation */
                        dev_kfree_skb(oldskb);
                }
-               /* Make buffer alignment 2 beyond a 16 byte boundary
-                * this will result in a 16 byte aligned IP header after
-                * the 14 byte MAC header is removed
-                */
-               skb_reserve(skb, NET_IP_ALIGN);
-
                buffer_info->skb = skb;
                buffer_info->length = adapter->rx_buffer_len;
 check_page:
@@ -4044,7 +4059,7 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
        struct e1000_buffer *buffer_info;
        struct sk_buff *skb;
        unsigned int i;
-       unsigned int bufsz = adapter->rx_buffer_len + NET_IP_ALIGN;
+       unsigned int bufsz = adapter->rx_buffer_len;
 
        i = rx_ring->next_to_use;
        buffer_info = &rx_ring->buffer_info[i];
@@ -4056,7 +4071,7 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                        goto map_skb;
                }
 
-               skb = netdev_alloc_skb(netdev, bufsz);
+               skb = netdev_alloc_skb_ip_align(netdev, bufsz);
                if (unlikely(!skb)) {
                        /* Better luck next round */
                        adapter->alloc_rx_buff_failed++;
@@ -4069,7 +4084,7 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                        DPRINTK(RX_ERR, ERR, "skb align check failed: %u bytes "
                                             "at %p\n", bufsz, skb->data);
                        /* Try again, without freeing the previous */
-                       skb = netdev_alloc_skb(netdev, bufsz);
+                       skb = netdev_alloc_skb_ip_align(netdev, bufsz);
                        /* Failed allocation, critical failure */
                        if (!skb) {
                                dev_kfree_skb(oldskb);
@@ -4088,12 +4103,6 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                        /* Use new allocation */
                        dev_kfree_skb(oldskb);
                }
-               /* Make buffer alignment 2 beyond a 16 byte boundary
-                * this will result in a 16 byte aligned IP header after
-                * the 14 byte MAC header is removed
-                */
-               skb_reserve(skb, NET_IP_ALIGN);
-
                buffer_info->skb = skb;
                buffer_info->length = adapter->rx_buffer_len;
 map_skb: