Commit 5e8d06fe authored by François Romieu's avatar François Romieu Committed by Russell King

[netdrvr r8169] fix TX descriptor overflow

Please apply attached patch.

Without patch, bogus descriptors are parsed as soon as
tp->cur_tx%NUM_TX_DESC + (tp->cur_tx - tp->dirty_tx) > NUM_TX_DESC
(assume for instance tp->dirty_tx = NUM_TX_DESC/2,
tp->cur_tx = NUM_TX_DESC - 1 and watch entry go beyond NUM_TX_DESC).

Missing stats update is fixed by the patch btw.
parent 9abdbe60
......@@ -871,7 +871,6 @@ rtl8169_tx_interrupt(struct net_device *dev, struct rtl8169_private *tp,
void *ioaddr)
{
unsigned long dirty_tx, tx_left = 0;
int entry = tp->cur_tx % NUM_TX_DESC;
assert(dev != NULL);
assert(tp != NULL);
......@@ -881,14 +880,18 @@ rtl8169_tx_interrupt(struct net_device *dev, struct rtl8169_private *tp,
tx_left = tp->cur_tx - dirty_tx;
while (tx_left > 0) {
int entry = dirty_tx % NUM_TX_DESC;
if ((tp->TxDescArray[entry].status & OWNbit) == 0) {
dev_kfree_skb_irq(tp->
Tx_skbuff[dirty_tx % NUM_TX_DESC]);
tp->Tx_skbuff[dirty_tx % NUM_TX_DESC] = NULL;
struct sk_buff *skb = tp->Tx_skbuff[entry];
tp->stats.tx_bytes += skb->len >= ETH_ZLEN ?
skb->len : ETH_ZLEN;
tp->stats.tx_packets++;
dev_kfree_skb_irq(skb);
tp->Tx_skbuff[entry] = NULL;
dirty_tx++;
tx_left--;
entry++;
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment