src/patches/suse-2.6.27.39/patches.drivers/ipoib_null_skb_on_free.patch

   1 From:   Arthur Kepner <akepner@sgi.com>
   2 Subject: ipoib NULL skb pointers on free
   3 References: bnc#503635
   4
   5 Acked-by: John Jolly <jjolly@suse.de>
   6
   7 Index: linux-2.6.27-SLE11_BRANCH/drivers/infiniband/ulp/ipoib/ipoib_cm.c
   8 ===================================================================
   9 --- linux-2.6.27-SLE11_BRANCH.orig/drivers/infiniband/ulp/ipoib/ipoib_cm.c
  10 +++ linux-2.6.27-SLE11_BRANCH/drivers/infiniband/ulp/ipoib/ipoib_cm.c
  11 @@ -200,6 +200,7 @@ static void ipoib_cm_free_rx_ring(struct
  12                         ipoib_cm_dma_unmap_rx(priv, IPOIB_CM_RX_SG - 1,
  13                                               rx_ring[i].mapping);
  14                         dev_kfree_skb_any(rx_ring[i].skb);
  15 +                       rx_ring[i].skb = NULL;
  16                 }
  17
  18         vfree(rx_ring);
  19 @@ -736,6 +737,7 @@ void ipoib_cm_send(struct net_device *de
  20         if (unlikely(ib_dma_mapping_error(priv->ca, addr))) {
  21                 ++dev->stats.tx_errors;
  22                 dev_kfree_skb_any(skb);
  23 +               tx_req->skb = NULL;
  24                 return;
  25         }
  26
  27 @@ -747,6 +749,7 @@ void ipoib_cm_send(struct net_device *de
  28                 ++dev->stats.tx_errors;
  29                 ib_dma_unmap_single(priv->ca, addr, skb->len, DMA_TO_DEVICE);
  30                 dev_kfree_skb_any(skb);
  31 +               tx_req->skb = NULL;
  32         } else {
  33                 dev->trans_start = jiffies;
  34                 ++tx->tx_head;
  35 @@ -785,6 +788,7 @@ void ipoib_cm_handle_tx_wc(struct net_de
  36         dev->stats.tx_bytes += tx_req->skb->len;
  37
  38         dev_kfree_skb_any(tx_req->skb);
  39 +       tx_req->skb = NULL;
  40
  41         spin_lock_irqsave(&priv->tx_lock, flags);
  42         ++tx->tx_tail;
  43 @@ -1179,6 +1183,7 @@ timeout:
  44                 ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len,
  45                                     DMA_TO_DEVICE);
  46                 dev_kfree_skb_any(tx_req->skb);
  47 +               tx_req->skb = NULL;
  48                 ++p->tx_tail;
  49                 spin_lock_irqsave(&priv->tx_lock, flags);
  50                 if (unlikely(--priv->tx_outstanding == ipoib_sendq_size >> 1) &&
  51 Index: linux-2.6.27-SLE11_BRANCH/drivers/infiniband/ulp/ipoib/ipoib_ib.c
  52 ===================================================================
  53 --- linux-2.6.27-SLE11_BRANCH.orig/drivers/infiniband/ulp/ipoib/ipoib_ib.c
  54 +++ linux-2.6.27-SLE11_BRANCH/drivers/infiniband/ulp/ipoib/ipoib_ib.c
  55 @@ -377,12 +377,14 @@ static void ipoib_ib_handle_tx_wc(struct
  56
  57         tx_req = &priv->tx_ring[wr_id];
  58
  59 -       ipoib_dma_unmap_tx(priv->ca, tx_req);
  60 +       if (tx_req->skb) {
  61 +               struct sk_buff *skb = tx_req->skb;
  62
  63 -       ++dev->stats.tx_packets;
  64 -       dev->stats.tx_bytes += tx_req->skb->len;
  65 -
  66 -       dev_kfree_skb_any(tx_req->skb);
  67 +               ipoib_dma_unmap_tx(priv->ca, tx_req);
  68 +               ++dev->stats.tx_packets;
  69 +               dev->stats.tx_bytes += skb->len;
  70 +               dev_kfree_skb_any(skb);
  71 +       }
  72
  73         ++priv->tx_tail;
  74         if (unlikely(--priv->tx_outstanding == ipoib_sendq_size >> 1) &&
  75 @@ -571,6 +573,7 @@ void ipoib_send(struct net_device *dev,
  76         if (unlikely(ipoib_dma_map_tx(priv->ca, tx_req))) {
  77                 ++dev->stats.tx_errors;
  78                 dev_kfree_skb_any(skb);
  79 +               tx_req->skb = NULL;
  80                 return;
  81         }
  82
  83 @@ -593,6 +596,7 @@ void ipoib_send(struct net_device *dev,
  84                 --priv->tx_outstanding;
  85                 ipoib_dma_unmap_tx(priv->ca, tx_req);
  86                 dev_kfree_skb_any(skb);
  87 +               tx_req->skb = NULL;
  88                 if (netif_queue_stopped(dev))
  89                         netif_wake_queue(dev);
  90         } else {