From 2bcccf73c0dd992b24a3594c62edfdf13103de1c Mon Sep 17 00:00:00 2001 From: Joel Sherrill Date: Wed, 21 Jan 2009 18:18:11 +0000 Subject: [PATCH] 2009-01-21 Frank Ueberschar PR 1354/bsps * network/network.c: In some cases it can occur that an empty mbuf is put on the descriptor chain. (We found it especially then when transmitting fragmented IP Packets.) Since the actual buffer descriptor pointer will be incremented after every inserted mbuf (txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current mbuf was zero. This leads to the bug. --- c/src/lib/libbsp/m68k/av5282/ChangeLog | 10 ++++++++++ c/src/lib/libbsp/m68k/av5282/network/network.c | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/c/src/lib/libbsp/m68k/av5282/ChangeLog b/c/src/lib/libbsp/m68k/av5282/ChangeLog index 560ced24df..7c1e350b75 100644 --- a/c/src/lib/libbsp/m68k/av5282/ChangeLog +++ b/c/src/lib/libbsp/m68k/av5282/ChangeLog @@ -1,3 +1,13 @@ +2009-01-21 Frank Ueberschar + + PR 1354/bsps + * network/network.c: In some cases it can occur that an empty mbuf is + put on the descriptor chain. (We found it especially then when + transmitting fragmented IP Packets.) Since the actual buffer + descriptor pointer will be incremented after every inserted mbuf + (txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current + mbuf was zero. This leads to the bug. + 2008-03-03 Joel Sherrill * startup/linkcmds, startup/linkcmdsflash, startup/linkcmdsram: Add diff --git a/c/src/lib/libbsp/m68k/av5282/network/network.c b/c/src/lib/libbsp/m68k/av5282/network/network.c index 7575072425..2dcf1d1e04 100644 --- a/c/src/lib/libbsp/m68k/av5282/network/network.c +++ b/c/src/lib/libbsp/m68k/av5282/network/network.c @@ -548,10 +548,10 @@ fec_sendpacket(struct ifnet *ifp, struct mbuf *m) * The IP fragmentation routine in ip_output * can produce fragments with zero length. */ - txBd = sc->txBdBase + sc->txBdHead; if (m->m_len){ char *p = mtod(m, char *); int offset = (int) p & 0x3; + txBd = sc->txBdBase + sc->txBdHead; if (offset == 0) { txBd->buffer = p; txBd->length = m->m_len;