Merge "net: hns: Fix a skb used after free bug" (0666c38c) · Commits · e / devices / android_kernel_sony_msm8998

drivers/net/ethernet/hisilicon/hns/hns_enet.c

+10 −12

Original line number	Diff line number	Diff line
		@@ -100,7 +100,7 @@ static void unfill_desc(struct hnae_ring *ring)
		ring_ptr_move_bw(ring, next_to_use);
		}

		int hns_nic_net_xmit_hw(struct net_device *ndev,
		netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
		struct sk_buff *skb,
		struct hns_nic_ring_data *ring_data)
		{
		@@ -172,6 +172,10 @@ int hns_nic_net_xmit_hw(struct net_device *ndev,
		dev_queue = netdev_get_tx_queue(ndev, skb->queue_mapping);
		netdev_tx_sent_queue(dev_queue, skb->len);

		ndev->trans_start = jiffies;
		ndev->stats.tx_bytes += skb->len;
		ndev->stats.tx_packets++;

		wmb(); /* commit all data before submit */
		assert(skb->queue_mapping < priv->ae_handle->q_num);
		hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
		@@ -1089,17 +1093,11 @@ static netdev_tx_t hns_nic_net_xmit(struct sk_buff *skb,
		struct net_device *ndev)
		{
		struct hns_nic_priv *priv = netdev_priv(ndev);
		int ret;

		assert(skb->queue_mapping < ndev->ae_handle->q_num);
		ret = hns_nic_net_xmit_hw(ndev, skb,

		return hns_nic_net_xmit_hw(ndev, skb,
		&tx_ring_data(priv, skb->queue_mapping));
		if (ret == NETDEV_TX_OK) {
		ndev->trans_start = jiffies;
		ndev->stats.tx_bytes += skb->len;
		ndev->stats.tx_packets++;
		}
		return (netdev_tx_t)ret;
		}

		static int hns_nic_change_mtu(struct net_device *ndev, int new_mtu)

+3 −3

Original line number	Diff line number	Diff line
		@@ -77,7 +77,7 @@ void hns_ethtool_set_ops(struct net_device *ndev);
		void hns_nic_net_reset(struct net_device *ndev);
		void hns_nic_net_reinit(struct net_device *netdev);
		int hns_nic_init_phy(struct net_device ndev, struct hnae_handle h);
		int hns_nic_net_xmit_hw(struct net_device *ndev,
		netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
		struct sk_buff *skb,
		struct hns_nic_ring_data *ring_data);