update to 2.7

[pve-qemu-kvm.git] / debian / patches / extra / CVE-2016-7907-net-imx-limit-buffer-descriptor-count.patch

diff --git a/debian/patches/extra/CVE-2016-7907-net-imx-limit-buffer-descriptor-count.patch b/debian/patches/extra/CVE-2016-7907-net-imx-limit-buffer-descriptor-count.patch
index 303a481bbb5698cf5d11020ea22a8de9e59305dc..108219cd123b62bdb84099e064d90c684fc29afc 100644 (file)
--- a/debian/patches/extra/CVE-2016-7907-net-imx-limit-buffer-descriptor-count.patch
+++ b/debian/patches/extra/CVE-2016-7907-net-imx-limit-buffer-descriptor-count.patch
@@ -1,7 +1,7 @@
-From 53102ff7c9c928e2c778a6440f7039ee29dc5acf Mon Sep 17 00:00:00 2001
+From 3798522afcf58abbce6de67446fcae7a34ae919d Mon Sep 17 00:00:00 2001
 From: Prasad J Pandit <pjp@fedoraproject.org>
 Date: Thu, 22 Sep 2016 16:01:38 +0530
-Subject: [PATCH 3/5] net: imx: limit buffer descriptor count
+Subject: [PATCH 5/7] net: imx: limit buffer descriptor count
 
 i.MX Fast Ethernet Controller uses buffer descriptors to manage
 data flow to/fro receive & transmit queues. While transmitting
@@ -16,25 +16,25 @@ Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index e60e338..547fa99 100644
+index 1c415ab..1d74827 100644
 --- a/hw/net/imx_fec.c
 +++ b/hw/net/imx_fec.c
-@@ -94,6 +94,8 @@ static const VMStateDescription vmstate_imx_fec = {
+@@ -220,6 +220,8 @@ static const VMStateDescription vmstate_imx_eth = {
  #define PHY_INT_PARFAULT            (1 << 2)
  #define PHY_INT_AUTONEG_PAGE        (1 << 1)
  
 +#define IMX_MAX_DESC                1024
 +
- static void imx_fec_update(IMXFECState *s);
+ static void imx_eth_update(IMXFECState *s);
  
  /*
-@@ -264,12 +266,12 @@ static void imx_fec_update(IMXFECState *s)
+@@ -402,12 +404,12 @@ static void imx_eth_update(IMXFECState *s)
  
  static void imx_fec_do_tx(IMXFECState *s)
  {
 -    int frame_size = 0;
 +    int frame_size = 0, descnt = 0;
-     uint8_t frame[FEC_MAX_FRAME_SIZE];
+     uint8_t frame[ENET_MAX_FRAME_SIZE];
      uint8_t *ptr = frame;
      uint32_t addr = s->tx_descriptor;