Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d344bff9 authored by Dale Farnsworth's avatar Dale Farnsworth Committed by Jeff Garzik
Browse files

mv643xx_eth: Fix race condition in mv643xx_eth_free_tx_descs 



mv643xx_eth: Fix race condition in mv643xx_eth_free_tx_descs

This bug was found and isolated by Thibaut VARENE <T-Bone@parisc-linux.org>
and Jarek Poplawski <jarkao2@o2.pl>.  This patch is a modification of their
fixes.  We acquire and release the lock for each descriptor that is freed
to minimize the time the lock is held.

Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent 3196265e

drivers/net/mv643xx_eth.c

+9 −2
Original line number Diff line number Diff line
@@ -314,6 +314,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force) 


	while (mp->tx_desc_count > 0) {

		spin_lock_irqsave(&mp->lock, flags);



		/* tx_desc_count might have changed before acquiring the lock */

		if (mp->tx_desc_count <= 0) {

			spin_unlock_irqrestore(&mp->lock, flags);

			return released;

		}



		tx_index = mp->tx_used_desc_q;

		desc = &mp->p_tx_desc_area[tx_index];

		cmd_sts = desc->cmd_sts;
@@ -332,13 +339,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force) 
		if (skb)

			mp->tx_skb[tx_index] = NULL;



		spin_unlock_irqrestore(&mp->lock, flags);



		if (cmd_sts & ETH_ERROR_SUMMARY) {

			printk("%s: Error in TX\n", dev->name);

			mp->stats.tx_errors++;

		}



		spin_unlock_irqrestore(&mp->lock, flags);



		if (cmd_sts & ETH_TX_FIRST_DESC)

			dma_unmap_single(NULL, addr, count, DMA_TO_DEVICE);

		else