Patchwork [1/2] e1000: Fix DMA mapping error handling on TX

login
register
mail settings
Submitter roel kluin
Date Feb. 4, 2010, 1 p.m.
Message ID <4B6AC4E5.4080104@gmail.com>
Download mbox | patch
Permalink /patch/44470/
State Awaiting Upstream
Delegated to: David Miller
Headers show

Comments

roel kluin - Feb. 4, 2010, 1 p.m.
These functions have off by one errors in their dma mapping error cleanup
paths. We decrement count and never clean the first successfully mapped
descriptor.

Reported-by: "Anton Blanchard" <anton@samba.org>
Reported-by: "Juha Leppanen" <juha_motorsportcom@luukku.com>
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
 drivers/net/e1000e/netdev.c    |    4 +---
 drivers/net/igbvf/netdev.c     |    4 +---
 drivers/net/ixgb/ixgb_main.c   |    4 +---
 drivers/net/ixgbe/ixgbe_main.c |    4 +---
 4 files changed, 4 insertions(+), 12 deletions(-)

My previous fix inadvertently introduced this change.

The e1000_tx_map() function in drivers/net/e1000/e1000_main.c is already
fixed by the patch sent by Anton Blanchard that can be found here:

http://www.mail-archive.com/e1000-devel@lists.sourceforge.net/msg02313.html

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 57f149b..57c3d44 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -3967,12 +3967,10 @@  static int e1000_tx_map(struct e1000_adapter *adapter,
 dma_error:
 	dev_err(&pdev->dev, "TX DMA map failed\n");
 	buffer_info->dma = 0;
-	if (count)
-		count--;
 
 	while (count--) {
 		if (i==0)
-			i += tx_ring->count;
+			i = tx_ring->count;
 		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		e1000_put_txbuf(adapter, buffer_info);;
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 2aa71a7..3b12603 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -2164,13 +2164,11 @@  dma_error:
 	buffer_info->length = 0;
 	buffer_info->next_to_watch = 0;
 	buffer_info->mapped_as_page = false;
-	if (count)
-		count--;
 
 	/* clear timestamp and dma mappings for remaining portion of packet */
 	while (count--) {
 		if (i==0)
-			i += tx_ring->count;
+			i = tx_ring->count;
 		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		igbvf_put_txbuf(adapter, buffer_info);
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index 593d1a4..de9b36c 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1363,12 +1363,10 @@  ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
 dma_error:
 	dev_err(&pdev->dev, "TX DMA map failed\n");
 	buffer_info->dma = 0;
-	if (count)
-		count--;
 
 	while (count--) {
 		if (i==0)
-			i += tx_ring->count;
+			i = tx_ring->count;
 		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		ixgb_unmap_and_free_tx_resource(adapter, buffer_info);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index b5f64ad..1713258 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5167,13 +5167,11 @@  dma_error:
 	tx_buffer_info->dma = 0;
 	tx_buffer_info->time_stamp = 0;
 	tx_buffer_info->next_to_watch = 0;
-	if (count)
-		count--;
 
 	/* clear timestamp and dma mappings for remaining portion of packet */
 	while (count--) {
 		if (i==0)
-			i += tx_ring->count;
+			i = tx_ring->count;
 		i--;
 		tx_buffer_info = &tx_ring->tx_buffer_info[i];
 		ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);