ibmtr: possible Read buffer overflow?

[safe/jmp/linux-2.6] / drivers / net / tokenring / ibmtr.c

diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index f195d54..6a3c751 100644 (file)
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -191,7 +191,8 @@ static int  tok_init_card(struct net_device *dev);
 static void    tok_open_adapter(unsigned long dev_addr);
 static void    open_sap(unsigned char type, struct net_device *dev);
 static void    tok_set_multicast_list(struct net_device *dev);
-static int     tok_send_packet(struct sk_buff *skb, struct net_device *dev);
+static netdev_tx_t tok_send_packet(struct sk_buff *skb,
+                                        struct net_device *dev);
 static int     tok_close(struct net_device *dev);
 static irqreturn_t tok_interrupt(int irq, void *dev_id);
 static void    initial_tok_int(struct net_device *dev);
@@ -815,17 +816,21 @@ static unsigned char __devinit get_sram_size(struct tok_info *adapt_info)
 
 /*****************************************************************************/
 
+static const struct net_device_ops trdev_netdev_ops = {
+       .ndo_open               = tok_open,
+       .ndo_stop               = tok_close,
+       .ndo_start_xmit         = tok_send_packet,
+       .ndo_set_multicast_list = tok_set_multicast_list,
+       .ndo_change_mtu         = ibmtr_change_mtu,
+};
+
 static int __devinit trdev_init(struct net_device *dev)
 {
        struct tok_info *ti = netdev_priv(dev);
 
        SET_PAGE(ti->srb_page);
         ti->open_failure = NO    ;
-       dev->open = tok_open;
-       dev->stop = tok_close;
-       dev->hard_start_xmit = tok_send_packet;
-       dev->set_multicast_list = tok_set_multicast_list;
-       dev->change_mtu = ibmtr_change_mtu;
+       dev->netdev_ops = &trdev_netdev_ops;
 
        return 0;
 }
@@ -1018,7 +1023,8 @@ static void tok_set_multicast_list(struct net_device *dev)
 
 #define STATION_ID_OFST 4
 
-static int tok_send_packet(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t tok_send_packet(struct sk_buff *skb,
+                                        struct net_device *dev)
 {
        struct tok_info *ti;
        unsigned long flags;
@@ -1037,7 +1043,7 @@ static int tok_send_packet(struct sk_buff *skb, struct net_device *dev)
        writeb(CMD_IN_SRB, ti->mmio + ACA_OFFSET + ACA_SET + ISRA_ODD);
        spin_unlock_irqrestore(&(ti->lock), flags);
        dev->trans_start = jiffies;
-       return 0;
+       return NETDEV_TX_OK;
 }
 
 /*****************************************************************************/
@@ -1137,9 +1143,16 @@ static void dir_open_adapter (struct net_device *dev)
                 } else {
                        char **prphase = printphase;
                        char **prerror = printerror;
+                       int pnr = err / 16 - 1;
+                       int enr = err % 16 - 1;
                        DPRINTK("TR Adapter misc open failure, error code = ");
-                       printk("0x%x, Phase: %s, Error: %s\n",
-                               err, prphase[err/16 -1], prerror[err%16 -1]);
+                       if (pnr < 0 || pnr >= ARRAY_SIZE(printphase) ||
+                                       enr < 0 ||
+                                       enr >= ARRAY_SIZE(printerror))
+                               printk("0x%x, invalid Phase/Error.", err);
+                       else
+                               printk("0x%x, Phase: %s, Error: %s\n", err,
+                                               prphase[pnr], prerror[enr]);
                        printk(" retrying after %ds delay...\n",
                                        TR_RETRY_INTERVAL/HZ);
                 }
@@ -1908,7 +1921,7 @@ static int __init ibmtr_init(void)
 
        find_turbo_adapters(io);
 
-       for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+       for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                struct net_device *dev;
                irq[i] = 0;
                mem[i] = 0;