Annotation of /trunk/kernel26-magellan/patches-2.6.21-r2/0300-2.6.21-sis900-oops-fix.patch
Parent Directory | Revision Log
Revision 200 -
(hide annotations)
(download)
Sat May 19 14:08:35 2007 UTC (17 years, 4 months ago) by niro
File size: 2564 byte(s)
Sat May 19 14:08:35 2007 UTC (17 years, 4 months ago) by niro
File size: 2564 byte(s)
-rev bump to 2.6.21-magellan-r2; disabled acpi-dsdt patch, broken -> "runaway loop request module binfmt-0000"
1 | niro | 200 | From: Neil Horman <nhorman@tuxdriver.com> |
2 | Date: Thu, 26 Apr 2007 17:47:36 +0000 (-0400) | ||
3 | Subject: sis900: Allocate rx replacement buffer before rx operation | ||
4 | X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=dc5a144991ba803bc8afded105c9db1dea0e57ab | ||
5 | |||
6 | sis900: Allocate rx replacement buffer before rx operation | ||
7 | |||
8 | Just found a hole in my last patch. It was reported to me that shortly after we | ||
9 | integrated this patch. The report was of an oops that took place inside of | ||
10 | netif_rx when using the sis900 driver. Looking at my origional patch I noted | ||
11 | that there was a spot between the new skb_alloc and the refill_rx_ring label | ||
12 | where skb got reassigned to the pointer currently held in the rx_ring for the | ||
13 | purposes of receiveing the frame. The result of this is however that the buffer | ||
14 | that gets passed to netif_rx (if it is called), then gets placed right back into | ||
15 | the rx_ring. So if you receive frames fast enough the skb being processed by | ||
16 | the network stack can get corrupted. The reporter is testing out the fix I've | ||
17 | written for this below (I'm not near my hardware at the moment to test myself), | ||
18 | but I wanted to post it for review ASAP. I'll post test results when I hear | ||
19 | them, but I think this is a pretty straightforward fix. It just uses a separate | ||
20 | pointer to do the rx operation, so that we don't improperly reassign the pointer | ||
21 | that we use to refill the rx ring. | ||
22 | |||
23 | Signed-off-by: Neil Horman <nhorman@tuxdriver.com> | ||
24 | Signed-off-by: Jeff Garzik <jeff@garzik.org> | ||
25 | --- | ||
26 | |||
27 | --- | ||
28 | drivers/net/sis900.c | 9 +++++---- | ||
29 | 1 file changed, 5 insertions(+), 4 deletions(-) | ||
30 | |||
31 | Index: linux-2.6.21/drivers/net/sis900.c | ||
32 | =================================================================== | ||
33 | --- linux-2.6.21.orig/drivers/net/sis900.c | ||
34 | +++ linux-2.6.21/drivers/net/sis900.c | ||
35 | @@ -1754,6 +1754,7 @@ static int sis900_rx(struct net_device * | ||
36 | sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE; | ||
37 | } else { | ||
38 | struct sk_buff * skb; | ||
39 | + struct sk_buff * rx_skb; | ||
40 | |||
41 | pci_unmap_single(sis_priv->pci_dev, | ||
42 | sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE, | ||
43 | @@ -1787,10 +1788,10 @@ static int sis900_rx(struct net_device * | ||
44 | } | ||
45 | |||
46 | /* give the socket buffer to upper layers */ | ||
47 | - skb = sis_priv->rx_skbuff[entry]; | ||
48 | - skb_put(skb, rx_size); | ||
49 | - skb->protocol = eth_type_trans(skb, net_dev); | ||
50 | - netif_rx(skb); | ||
51 | + rx_skb = sis_priv->rx_skbuff[entry]; | ||
52 | + skb_put(rx_skb, rx_size); | ||
53 | + rx_skb->protocol = eth_type_trans(rx_skb, net_dev); | ||
54 | + netif_rx(rx_skb); | ||
55 | |||
56 | /* some network statistics */ | ||
57 | if ((rx_status & BCAST) == MCAST) |