Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.21-r2/0300-2.6.21-sis900-oops-fix.patch

    Contents of /trunk/kernel26-magellan/patches-2.6.21-r2/0300-2.6.21-sis900-oops-fix.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 200 - (show annotations) (download)
    Sat May 19 14:08:35 2007 UTC (17 years ago) by niro
    File size: 2564 byte(s) 
    -rev bump to 2.6.21-magellan-r2; disabled acpi-dsdt patch, broken -> "runaway loop request module binfmt-0000"
    1 From: Neil Horman <nhorman@tuxdriver.com>
    2 Date: Thu, 26 Apr 2007 17:47:36 +0000 (-0400)
    3 Subject: sis900: Allocate rx replacement buffer before rx operation
    4 X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=dc5a144991ba803bc8afded105c9db1dea0e57ab
    5
    6 sis900: Allocate rx replacement buffer before rx operation
    7
    8 Just found a hole in my last patch. It was reported to me that shortly after we
    9 integrated this patch. The report was of an oops that took place inside of
    10 netif_rx when using the sis900 driver. Looking at my origional patch I noted
    11 that there was a spot between the new skb_alloc and the refill_rx_ring label
    12 where skb got reassigned to the pointer currently held in the rx_ring for the
    13 purposes of receiveing the frame. The result of this is however that the buffer
    14 that gets passed to netif_rx (if it is called), then gets placed right back into
    15 the rx_ring. So if you receive frames fast enough the skb being processed by
    16 the network stack can get corrupted. The reporter is testing out the fix I've
    17 written for this below (I'm not near my hardware at the moment to test myself),
    18 but I wanted to post it for review ASAP. I'll post test results when I hear
    19 them, but I think this is a pretty straightforward fix. It just uses a separate
    20 pointer to do the rx operation, so that we don't improperly reassign the pointer
    21 that we use to refill the rx ring.
    22
    23 Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
    24 Signed-off-by: Jeff Garzik <jeff@garzik.org>
    25 ---
    26
    27 ---
    28 drivers/net/sis900.c | 9 +++++----
    29 1 file changed, 5 insertions(+), 4 deletions(-)
    30
    31 Index: linux-2.6.21/drivers/net/sis900.c
    32 ===================================================================
    33 --- linux-2.6.21.orig/drivers/net/sis900.c
    34 +++ linux-2.6.21/drivers/net/sis900.c
    35 @@ -1754,6 +1754,7 @@ static int sis900_rx(struct net_device *
    36 sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE;
    37 } else {
    38 struct sk_buff * skb;
    39 + struct sk_buff * rx_skb;
    40
    41 pci_unmap_single(sis_priv->pci_dev,
    42 sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
    43 @@ -1787,10 +1788,10 @@ static int sis900_rx(struct net_device *
    44 }
    45
    46 /* give the socket buffer to upper layers */
    47 - skb = sis_priv->rx_skbuff[entry];
    48 - skb_put(skb, rx_size);
    49 - skb->protocol = eth_type_trans(skb, net_dev);
    50 - netif_rx(skb);
    51 + rx_skb = sis_priv->rx_skbuff[entry];
    52 + skb_put(rx_skb, rx_size);
    53 + rx_skb->protocol = eth_type_trans(rx_skb, net_dev);
    54 + netif_rx(rx_skb);
    55
    56 /* some network statistics */
    57 if ((rx_status & BCAST) == MCAST)