PR 1354/bsps
	* network/network.c: In some cases it can occur that an empty mbuf is
	put on the descriptor chain. (We found it especially then when
	transmitting fragmented IP Packets.) Since the actual buffer
	descriptor pointer will be incremented after every inserted mbuf
	(txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current
	mbuf was zero. This leads to the bug.
This commit is contained in:
Joel Sherrill
2009-01-21 18:18:11 +00:00
parent e02d489afc
commit 2bcccf73c0
2 changed files with 11 additions and 1 deletions

View File

@@ -1,3 +1,13 @@
2009-01-21 Frank Ueberschar <frank.ueberschar@dsa-volgmann.de>
PR 1354/bsps
* network/network.c: In some cases it can occur that an empty mbuf is
put on the descriptor chain. (We found it especially then when
transmitting fragmented IP Packets.) Since the actual buffer
descriptor pointer will be incremented after every inserted mbuf
(txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current
mbuf was zero. This leads to the bug.
2008-03-03 Joel Sherrill <joel.sherrill@OARcorp.com>
* startup/linkcmds, startup/linkcmdsflash, startup/linkcmdsram: Add

View File

@@ -548,10 +548,10 @@ fec_sendpacket(struct ifnet *ifp, struct mbuf *m)
* The IP fragmentation routine in ip_output
* can produce fragments with zero length.
*/
txBd = sc->txBdBase + sc->txBdHead;
if (m->m_len){
char *p = mtod(m, char *);
int offset = (int) p & 0x3;
txBd = sc->txBdBase + sc->txBdHead;
if (offset == 0) {
txBd->buffer = p;
txBd->length = m->m_len;