| From 22a5aa41cb1a2077373a47a3361f628ec3c86589 Mon Sep 17 00:00:00 2001 |
| From: Eric Dumazet <eric.dumazet@gmail.com> |
| Date: Sat, 22 Oct 2011 03:29:53 -0400 |
| Subject: tg3: fix tigon3_dma_hwbug_workaround() |
| |
| |
| From: Eric Dumazet <eric.dumazet@gmail.com> |
| |
| [ Upstream commit f7ff19871bb4a3451e1ca2cf660bf633018cfbec ] |
| |
| Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3: |
| enable transmit time stamping." |
| |
| This is because tigon3_dma_hwbug_workaround() might alloc a new skb and |
| free the original. We panic when skb_tx_timestamp() is called on freed |
| skb. |
| |
| Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com> |
| Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| --- |
| drivers/net/tg3.c | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/net/tg3.c |
| +++ b/drivers/net/tg3.c |
| @@ -6029,12 +6029,12 @@ static void tg3_tx_skb_unmap(struct tg3_ |
| |
| /* Workaround 4GB and 40-bit hardware DMA bugs. */ |
| static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, |
| - struct sk_buff *skb, |
| + struct sk_buff **pskb, |
| u32 *entry, u32 *budget, |
| u32 base_flags, u32 mss, u32 vlan) |
| { |
| struct tg3 *tp = tnapi->tp; |
| - struct sk_buff *new_skb; |
| + struct sk_buff *new_skb, *skb = *pskb; |
| dma_addr_t new_addr = 0; |
| int ret = 0; |
| |
| @@ -6076,7 +6076,7 @@ static int tigon3_dma_hwbug_workaround(s |
| } |
| |
| dev_kfree_skb(skb); |
| - |
| + *pskb = new_skb; |
| return ret; |
| } |
| |
| @@ -6305,7 +6305,7 @@ static netdev_tx_t tg3_start_xmit(struct |
| */ |
| entry = tnapi->tx_prod; |
| budget = tg3_tx_avail(tnapi); |
| - if (tigon3_dma_hwbug_workaround(tnapi, skb, &entry, &budget, |
| + if (tigon3_dma_hwbug_workaround(tnapi, &skb, &entry, &budget, |
| base_flags, mss, vlan)) |
| goto out_unlock; |
| } |