lkml.org 
[lkml]   [2010]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] gainfar.c : skb_over_panic (kernel-2.6.32.15)
    Fix possible skb_over_panic event in Freescale's "gianfar" driver. 

    The skb_over_panic occurs due to calling skb_put() within
    gfar_clean_rx_ring(). This happens if (and only if) shortly prior to the
    event and a few lined above the skb_put(), an skb was queued back to the
    priv->rx_recycle queue due to RXBD_LAST or RXBD_ERR status.
    The skb is queued without properly re-setting its state.

    The patch properly reset the skb state.

    I have tested this patch on MPC8548 based product and asserted it avoided the skb_over_panic event.

    Signed-off-by: Eran Liberty <liberty@extricom.com>

    ---





    ---
    drivers/net/gianfar.c | 9 ++-------
    1 file changed, 2 insertions(+), 7 deletions(-)

    --- a/drivers/net/gianfar.c
    +++ b/drivers/net/gianfar.c
    @@ -1854,14 +1854,9 @@
    if (unlikely(!newskb))
    newskb = skb;
    else if (skb) {
    - /*
    - * We need to reset ->data to what it
    - * was before gfar_new_skb() re-aligned
    - * it to an RXBUF_ALIGNMENT boundary
    - * before we put the skb back on the
    - * recycle list.
    - */
    skb->data = skb->head + NET_SKB_PAD;
    + skb->len = 0;
    + skb_reset_tail_pointer(skb);
    __skb_queue_head(&priv->rx_recycle, skb);
    }
    } else {
    \
     
     \ /
      Last update: 2010-06-24 11:59    [W:3.094 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site