diff options
| author | Joel Sherrill <joel.sherrill@OARcorp.com> | 2009-01-21 18:18:04 +0000 |
|---|---|---|
| committer | Joel Sherrill <joel.sherrill@OARcorp.com> | 2009-01-21 18:18:04 +0000 |
| commit | 1595171d96ab7c799ac6a4468a0832f4a618ef01 (patch) | |
| tree | 99583e2910a90eb72d4898c83b50446abbbcde91 | |
| parent | 92938438238875e365585be05663ba9f33b8802c (diff) | |
2009-01-21 Frank Ueberschar <frank.ueberschar@dsa-volgmann.de>
PR 1354/bsps
* network/network.c: In some cases it can occur that an empty mbuf is
put on the descriptor chain. (We found it especially then when
transmitting fragmented IP Packets.) Since the actual buffer
descriptor pointer will be incremented after every inserted mbuf
(txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current
mbuf was zero. This leads to the bug.
| -rw-r--r-- | c/src/lib/libbsp/m68k/av5282/ChangeLog | 10 | ||||
| -rw-r--r-- | c/src/lib/libbsp/m68k/av5282/network/network.c | 2 |
2 files changed, 11 insertions, 1 deletions
diff --git a/c/src/lib/libbsp/m68k/av5282/ChangeLog b/c/src/lib/libbsp/m68k/av5282/ChangeLog index f95e261ad8..e7ee7868ca 100644 --- a/c/src/lib/libbsp/m68k/av5282/ChangeLog +++ b/c/src/lib/libbsp/m68k/av5282/ChangeLog @@ -1,3 +1,13 @@ +2009-01-21 Frank Ueberschar <frank.ueberschar@dsa-volgmann.de> + + PR 1354/bsps + * network/network.c: In some cases it can occur that an empty mbuf is + put on the descriptor chain. (We found it especially then when + transmitting fragmented IP Packets.) Since the actual buffer + descriptor pointer will be incremented after every inserted mbuf + (txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current + mbuf was zero. This leads to the bug. + 2007-03-12 Joel Sherrill <joel@OARcorp.com> * include/coverhd.h, start/start.S, startup/bspclean.c, diff --git a/c/src/lib/libbsp/m68k/av5282/network/network.c b/c/src/lib/libbsp/m68k/av5282/network/network.c index 690506788c..2a37958ab9 100644 --- a/c/src/lib/libbsp/m68k/av5282/network/network.c +++ b/c/src/lib/libbsp/m68k/av5282/network/network.c @@ -548,10 +548,10 @@ fec_sendpacket(struct ifnet *ifp, struct mbuf *m) * The IP fragmentation routine in ip_output * can produce fragments with zero length. */ - txBd = sc->txBdBase + sc->txBdHead; if (m->m_len){ char *p = mtod(m, char *); int offset = (int) p & 0x3; + txBd = sc->txBdBase + sc->txBdHead; if (offset == 0) { txBd->buffer = p; txBd->length = m->m_len; |