Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[BNX2]: Fix panic in bnx2_tx_int().

Browse source 
There was an off-by-one bug in bnx2_tx_avail().  If the tx ring is
completely full, the producer and consumer indices may be apart by
256 even though the ring size is only 255.  One entry in the ring is
unused and must be properly accounted for when calculating the number
of available entries.  The bug caused the tx ring entries to be
reused by mistake, overwriting active entries, and ultimately causing
it to crash.

This bug rarely occurs because the tx ring is rarely completely full.
We always stop when there is less than MAX_SKB_FRAGS entries available
in the ring.

Thanks to Corey Kovacs <cjk@techma.com> and Andy Gospodarek
<agospoda@redhat.com> for reporting the problem and helping to collect
debug information.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Michael Chan 2006-12-14 15:56:32 -08:00 committed by David S. Miller
parent a3d384029a
commit faac9c4b75
1 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/net/bnx2.c
View file

@ -217,9 +217,16 @@ static inline u32 bnx2_tx_avail(struct bnx2 *bp)
u32 diff;
smp_mb();
diff = TX_RING_IDX(bp->tx_prod) - TX_RING_IDX(bp->tx_cons);
if (diff > MAX_TX_DESC_CNT)
diff = (diff & MAX_TX_DESC_CNT) - 1;
/* The ring uses 256 indices for 255 entries, one of them
* needs to be skipped.
*/
diff = bp->tx_prod - bp->tx_cons;
if (unlikely(diff >= TX_DESC_CNT)) {
diff &= 0xffff;
if (diff == TX_DESC_CNT)
diff = MAX_TX_DESC_CNT;
}
return (bp->tx_ring_size - diff);
}