Contents of /trunk/kernel26-magellan/patches-2.6.21-r1/0300-2.6.21-sis900-oops-fix.patch
Parent Directory | Revision Log
Revision 196 -
(show annotations)
(download)
Thu May 17 23:20:52 2007 UTC (17 years ago) by niro
File size: 2564 byte(s)
Thu May 17 23:20:52 2007 UTC (17 years ago) by niro
File size: 2564 byte(s)
-ver bump to 2.6.21-r1 using: -linux-2.6.21.1 -2.6.21-ck2 patchset -fbsplash-0.9.2-r5 -vesafb-tng-1.0-rc2 -squashfs-3.2-r2 -unionfs-2.0-u2 -suspend2-2.2.9.17 -linux-phc-0.2.10 -acpi-dsdt-0.8.4 -fuse-2.6.5 -reiser4-mm -nvidia-drivers-1.0.9755 -ati-drivers-8.36.5 -ipw3945-1.2.1 - added a fix for sis900 oops on linux-2.6.21
1 | From: Neil Horman <nhorman@tuxdriver.com> |
2 | Date: Thu, 26 Apr 2007 17:47:36 +0000 (-0400) |
3 | Subject: sis900: Allocate rx replacement buffer before rx operation |
4 | X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=dc5a144991ba803bc8afded105c9db1dea0e57ab |
5 | |
6 | sis900: Allocate rx replacement buffer before rx operation |
7 | |
8 | Just found a hole in my last patch. It was reported to me that shortly after we |
9 | integrated this patch. The report was of an oops that took place inside of |
10 | netif_rx when using the sis900 driver. Looking at my origional patch I noted |
11 | that there was a spot between the new skb_alloc and the refill_rx_ring label |
12 | where skb got reassigned to the pointer currently held in the rx_ring for the |
13 | purposes of receiveing the frame. The result of this is however that the buffer |
14 | that gets passed to netif_rx (if it is called), then gets placed right back into |
15 | the rx_ring. So if you receive frames fast enough the skb being processed by |
16 | the network stack can get corrupted. The reporter is testing out the fix I've |
17 | written for this below (I'm not near my hardware at the moment to test myself), |
18 | but I wanted to post it for review ASAP. I'll post test results when I hear |
19 | them, but I think this is a pretty straightforward fix. It just uses a separate |
20 | pointer to do the rx operation, so that we don't improperly reassign the pointer |
21 | that we use to refill the rx ring. |
22 | |
23 | Signed-off-by: Neil Horman <nhorman@tuxdriver.com> |
24 | Signed-off-by: Jeff Garzik <jeff@garzik.org> |
25 | --- |
26 | |
27 | --- |
28 | drivers/net/sis900.c | 9 +++++---- |
29 | 1 file changed, 5 insertions(+), 4 deletions(-) |
30 | |
31 | Index: linux-2.6.21/drivers/net/sis900.c |
32 | =================================================================== |
33 | --- linux-2.6.21.orig/drivers/net/sis900.c |
34 | +++ linux-2.6.21/drivers/net/sis900.c |
35 | @@ -1754,6 +1754,7 @@ static int sis900_rx(struct net_device * |
36 | sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE; |
37 | } else { |
38 | struct sk_buff * skb; |
39 | + struct sk_buff * rx_skb; |
40 | |
41 | pci_unmap_single(sis_priv->pci_dev, |
42 | sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE, |
43 | @@ -1787,10 +1788,10 @@ static int sis900_rx(struct net_device * |
44 | } |
45 | |
46 | /* give the socket buffer to upper layers */ |
47 | - skb = sis_priv->rx_skbuff[entry]; |
48 | - skb_put(skb, rx_size); |
49 | - skb->protocol = eth_type_trans(skb, net_dev); |
50 | - netif_rx(skb); |
51 | + rx_skb = sis_priv->rx_skbuff[entry]; |
52 | + skb_put(rx_skb, rx_size); |
53 | + rx_skb->protocol = eth_type_trans(rx_skb, net_dev); |
54 | + netif_rx(rx_skb); |
55 | |
56 | /* some network statistics */ |
57 | if ((rx_status & BCAST) == MCAST) |