git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 45d640b3ac6aedc166ec16f2581763fbf36ed6e7 Mon Sep 17 00:00:00 2001
   2 From: Jarek Poplawski <jarkao2@gmail.com>
   3 Date: Tue, 19 Oct 2010 00:06:36 +0000
   4 Subject: gianfar: Fix crashes on RX path (Was Re: [Bugme-new] [Bug 19692] New: linux-2.6.36-rc5 crash with gianfar ethernet at full line rate traffic)
   5
   6
   7 From: Jarek Poplawski <jarkao2@gmail.com>
   8
   9 [ Upstream commit 0d1fe1111c667e9c713d7efc7ae468a605f236a4 ]
  10
  11 The rx_recycle queue is global per device but can be accesed by many
  12 napi handlers at the same time, so it needs full skb_queue primitives
  13 (with locking). Otherwise, various crashes caused by broken skbs are
  14 possible.
  15
  16 This patch resolves, at least partly, bugzilla bug 19692. (Because of
  17 some doubts that there could be still something around which is hard
  18 to reproduce my proposal is to leave this bug opened for a month.)
  19
  20 Fixes commit: 0fd56bb5be6455d0d42241e65aed057244665e5e ("gianfar: Add
  21 support for skb recycling")
  22
  23 Reported-by: emin ak <eminak71@gmail.com>
  24 Tested-by: emin ak <eminak71@gmail.com>
  25 Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
  26 CC: Andy Fleming <afleming@freescale.com>
  27 Signed-off-by: David S. Miller <davem@davemloft.net>
  28 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  29 ---
  30  drivers/net/gianfar.c |    6 +++---
  31  1 file changed, 3 insertions(+), 3 deletions(-)
  32
  33 --- a/drivers/net/gianfar.c
  34 +++ b/drivers/net/gianfar.c
  35 @@ -1621,7 +1621,7 @@ static int gfar_clean_tx_ring(struct net
  36                 if (skb_queue_len(&priv->rx_recycle) < priv->rx_ring_size &&
  37                                 skb_recycle_check(skb, priv->rx_buffer_size +
  38                                         RXBUF_ALIGNMENT))
  39 -                       __skb_queue_head(&priv->rx_recycle, skb);
  40 +                       skb_queue_head(&priv->rx_recycle, skb);
  41                 else
  42                         dev_kfree_skb_any(skb);
  43
  44 @@ -1703,7 +1703,7 @@ struct sk_buff * gfar_new_skb(struct net
  45         struct gfar_private *priv = netdev_priv(dev);
  46         struct sk_buff *skb = NULL;
  47
  48 -       skb = __skb_dequeue(&priv->rx_recycle);
  49 +       skb = skb_dequeue(&priv->rx_recycle);
  50         if (!skb)
  51                 skb = netdev_alloc_skb(dev,
  52                                 priv->rx_buffer_size + RXBUF_ALIGNMENT);
  53 @@ -1862,7 +1862,7 @@ int gfar_clean_rx_ring(struct net_device
  54                                  * recycle list.
  55                                  */
  56                                 skb->data = skb->head + NET_SKB_PAD;
  57 -                               __skb_queue_head(&priv->rx_recycle, skb);
  58 +                               skb_queue_head(&priv->rx_recycle, skb);
  59                         }
  60                 } else {
  61                         /* Increment the number of packets */