Fix memory corruption in fec_mpc52xx

The mpc5200 fec driver is corrupting memory. This patch fixes two bugs
where the wrong skb was being referenced.

Signed-off-by: Jon Smirl <jonsmirl@gmail.com>
Acked-by: Domen Puncer <domen.puncer@telargo.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index bf5a7caa5b52dbf48f5a813ff338eddbb601423b..79f7eade477356938e113543e354baabef3d81be 100644 (file)
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -422,7 +422,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
 
                rskb = bcom_retrieve_buffer(priv->rx_dmatsk, &status,
                                (struct bcom_bd **)&bd);
-               dma_unmap_single(&dev->dev, bd->skb_pa, skb->len, DMA_FROM_DEVICE);
+               dma_unmap_single(&dev->dev, bd->skb_pa, rskb->len, DMA_FROM_DEVICE);
 
                /* Test for errors in received frame */
                if (status & BCOM_FEC_RX_BD_ERRORS) {
@@ -467,7 +467,7 @@ static irqreturn_t mpc52xx_fec_rx_interrupt(int irq, void *dev_id)
                        bcom_prepare_next_buffer(priv->rx_dmatsk);
 
                bd->status = FEC_RX_BUFFER_SIZE;
-               bd->skb_pa = dma_map_single(&dev->dev, rskb->data,
+               bd->skb_pa = dma_map_single(&dev->dev, skb->data,
                                FEC_RX_BUFFER_SIZE, DMA_FROM_DEVICE);
 
                bcom_submit_next_buffer(priv->rx_dmatsk, skb);