| From 9b0f04976f52506d3e2e023a03cdc95dbc1dc9ec Mon Sep 17 00:00:00 2001 |
| From: Marc Kleine-Budde <mkl@pengutronix.de> |
| Date: Wed, 9 Oct 2019 16:03:18 +0200 |
| Subject: [PATCH] can: rx-offload: can_rx_offload_offload_one(): do not |
| increase the skb_queue beyond skb_queue_len_max |
| |
| commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 upstream. |
| |
| The skb_queue is a linked list, holding the skb to be processed in the |
| next NAPI call. |
| |
| Without this patch, the queue length in can_rx_offload_offload_one() is |
| limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no |
| array or other resources are accessed out-of-bound, however this |
| behaviour is counterintuitive. |
| |
| This patch limits the rx-offload skb_queue length to skb_queue_len_max. |
| |
| Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading") |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c |
| index d1c863409945..bdc27481b57f 100644 |
| --- a/drivers/net/can/rx-offload.c |
| +++ b/drivers/net/can/rx-offload.c |
| @@ -115,7 +115,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload |
| int ret; |
| |
| /* If queue is full or skb not available, read to discard mailbox */ |
| - if (likely(skb_queue_len(&offload->skb_queue) <= |
| + if (likely(skb_queue_len(&offload->skb_queue) < |
| offload->skb_queue_len_max)) |
| skb = alloc_can_skb(offload->dev, &cf); |
| |
| -- |
| 2.7.4 |
| |
