blob: c24932f5ddf2255b6528fd462d31789126b7dfe2 [file] [log] [blame]
From 4cb6c04dc00065c3a85598fe36acd07907fb9e65 Mon Sep 17 00:00:00 2001
From: Edward Cree <>
Date: Mon, 9 Mar 2020 18:16:24 +0000
Subject: [PATCH] sfc: detach from cb_page in efx_copy_channel()
commit 4b1bd9db078f7d5332c8601a2f5bd43cf0458fd4 upstream.
It's a resource, not a parameter, so we can't copy it into the new
channel's TX queues, otherwise aliasing will lead to resource-
management bugs if the channel is subsequently torn down without
being initialised.
Before the Fixes:-tagged commit there was a similar bug with
tsoh_page, but I'm not sure it's worth doing another fix for such
old kernels.
Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2")
Suggested-by: Derek Shute <>
Signed-off-by: Edward Cree <>
Signed-off-by: David S. Miller <>
Signed-off-by: Paul Gortmaker <>
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 53b726bfe945..413ad2d029f8 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -519,6 +519,7 @@ efx_copy_channel(const struct efx_channel *old_channel)
if (tx_queue->channel)
tx_queue->channel = channel;
tx_queue->buffer = NULL;
+ tx_queue->cb_page = NULL;
memset(&tx_queue->txd, 0, sizeof(tx_queue->txd));