Commit 3b89624a authored by Nicolas Schichan's avatar Nicolas Schichan Committed by David S. Miller

net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.

The code in txq_put_data() would use txq->tx_curr_desc to index the
tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned
fragments, which is already moved to the next descriptor at the
beginning of the function.

If that fragment was the last of the the skb, the next skb would use
that same space to place the ip headers, overwritting that small
fragment data.

Fixes: 91986fd3 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path)
Signed-off-by: default avatarNicolas Schichan <nschichan@freebox.fr>
Reviewed-by: default avatarPhilipp Kirchhofer <philipp@familie-kirchhofer.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6ed74236
...@@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq, ...@@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
if (length <= 8 && (uintptr_t)data & 0x7) { if (length <= 8 && (uintptr_t)data & 0x7) {
/* Copy unaligned small data fragment to TSO header data area */ /* Copy unaligned small data fragment to TSO header data area */
memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE, memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE,
data, length); data, length);
desc->buf_ptr = txq->tso_hdrs_dma desc->buf_ptr = txq->tso_hdrs_dma
+ txq->tx_curr_desc * TSO_HEADER_SIZE; + tx_index * TSO_HEADER_SIZE;
} else { } else {
/* Alignment is okay, map buffer and hand off to hardware */ /* Alignment is okay, map buffer and hand off to hardware */
txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE; txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment