lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 010/294] net: bcmgenet: fix off-by-one in incrementing read pointer
    3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Fainelli <f.fainelli@gmail.com>

    commit cf377d886f7944a5ccdbd164b89949e13617b096 upstream.

    Commit b629be5c8399d7c423b92135eb43a86c924d1cbc ("net: bcmgenet: check
    harder for out of memory conditions") moved the increment of the local
    read pointer *before* reading from the hardware descriptor using
    dmadesc_get_length_status(), which creates an off-by-one situation.

    Fix this by moving again the read_ptr increment after we have read the
    hardware descriptor to get both the control block and the read pointer
    back in sync.

    Fixes: b629be5c8399 ("net: bcmgenet: check harder for out of memory conditions")
    Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com>
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Acked-by: Petri Gynther <pgynther@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
    +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
    @@ -1354,11 +1354,6 @@ static unsigned int bcmgenet_desc_rx(str
    cb = &priv->rx_cbs[priv->rx_read_ptr];
    skb = cb->skb;

    - rxpktprocessed++;
    -
    - priv->rx_read_ptr++;
    - priv->rx_read_ptr &= (priv->num_rx_bds - 1);
    -
    /* We do not have a backing SKB, so we do not have a
    * corresponding DMA mapping for this incoming packet since
    * bcmgenet_rx_refill always either has both skb and mapping or
    @@ -1471,6 +1466,10 @@ refill:
    err = bcmgenet_rx_refill(priv, cb);
    if (err)
    netif_err(priv, rx_err, dev, "Rx refill failed\n");
    +
    + rxpktprocessed++;
    + priv->rx_read_ptr++;
    + priv->rx_read_ptr &= (priv->num_rx_bds - 1);
    }

    return rxpktprocessed;
    \
     
     \ /
      Last update: 2017-11-08 20:59    [W:4.211 / U:0.392 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site