tokenring: Read buffer overflow

[safe/jmp/linux-2.6] / drivers / net / declance.c

diff --git a/drivers/net/declance.c b/drivers/net/declance.c
index b62405a..2b22e58 100644 (file)
--- a/drivers/net/declance.c
+++ b/drivers/net/declance.c
@@ -895,6 +895,7 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct lance_private *lp = netdev_priv(dev);
        volatile struct lance_regs *ll = lp->ll;
        volatile u16 *ib = (volatile u16 *)dev->mem_start;
+       unsigned long flags;
        int entry, len;
 
        len = skb->len;
@@ -907,6 +908,8 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
        dev->stats.tx_bytes += len;
 
+       spin_lock_irqsave(&lp->lock, flags);
+
        entry = lp->tx_new;
        *lib_ptr(ib, btx_ring[entry].length, lp->type) = (-len);
        *lib_ptr(ib, btx_ring[entry].misc, lp->type) = 0;
@@ -925,6 +928,8 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Kick the lance: transmit now */
        writereg(&ll->rdp, LE_C0_INEA | LE_C0_TDMD);
 
+       spin_unlock_irqrestore(&lp->lock, flags);
+
        dev->trans_start = jiffies;
        dev_kfree_skb(skb);