korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-17 01:04:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

e1000e: fix dma error handling issues

Browse Source 
There were a few issues I noticed in e1000e. These include a double free
of the skb if mapping fails, and the fact that context descriptors appear
to be left in the descriptor ring after the failure.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Alexander Duyck 2009-03-19 01:12:50 +00:00 committed by David S. Miller
parent 8c81c9c315
commit 1b7719c455
1 changed files with 32 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
drivers/net/e1000e/netdev.c
View File

@ -574,6 +574,7 @@ static void e1000_put_txbuf(struct e1000_adapter *adapter,
dev_kfree_skb_any(buffer_info->skb); dev_kfree_skb_any(buffer_info->skb);
buffer_info->skb = NULL; buffer_info->skb = NULL;
} }
buffer_info->time_stamp = 0;
} }
static void e1000_print_tx_hang(struct e1000_adapter *adapter) static void e1000_print_tx_hang(struct e1000_adapter *adapter)
@ -678,17 +679,10 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
} }
if (adapter->detect_tx_hung) { if (adapter->detect_tx_hung) {
/* /* Detect a transmit hang in hardware, this serializes the
* Detect a transmit hang in hardware, this serializes the * check with the clearing of time_stamp and movement of i */
* check with the clearing of time_stamp and movement of i
*/
adapter->detect_tx_hung = 0; adapter->detect_tx_hung = 0;
/* if (tx_ring->buffer_info[eop].time_stamp &&
* read barrier to make sure that the ->dma member and time
* stamp are updated fully
*/
smp_rmb();
if (tx_ring->buffer_info[eop].dma &&
time_after(jiffies, tx_ring->buffer_info[eop].time_stamp time_after(jiffies, tx_ring->buffer_info[eop].time_stamp
+ (adapter->tx_timeout_factor * HZ)) + (adapter->tx_timeout_factor * HZ))
&& !(er32(STATUS) & E1000_STATUS_TXOFF)) { && !(er32(STATUS) & E1000_STATUS_TXOFF)) {
@ -3824,39 +3818,41 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
unsigned int mss) unsigned int mss)
{ {
struct e1000_ring *tx_ring = adapter->tx_ring; struct e1000_ring *tx_ring = adapter->tx_ring;
struct e1000_buffer *buffer_info;
unsigned int len = skb_headlen(skb); unsigned int len = skb_headlen(skb);
unsigned int offset, size, count = 0, i; unsigned int offset, size, count = 0, i;
unsigned int f; unsigned int f;
dma_addr_t map; dma_addr_t *map;
i = tx_ring->next_to_use; i = tx_ring->next_to_use;
if (skb_dma_map(&adapter->pdev->dev, skb, DMA_TO_DEVICE)) { if (skb_dma_map(&adapter->pdev->dev, skb, DMA_TO_DEVICE)) {
dev_err(&adapter->pdev->dev, "TX DMA map failed\n"); dev_err(&adapter->pdev->dev, "TX DMA map failed\n");
adapter->tx_dma_failed++; adapter->tx_dma_failed++;
dev_kfree_skb(skb); return 0;
return -2;
} }
map = skb_shinfo(skb)->dma_maps[0]; map = skb_shinfo(skb)->dma_maps;
offset = 0; offset = 0;
while (len) { while (len) {
struct e1000_buffer *buffer_info = &tx_ring->buffer_info[i]; buffer_info = &tx_ring->buffer_info[i];
size = min(len, max_per_txd); size = min(len, max_per_txd);
buffer_info->length = size; buffer_info->length = size;
/* set time_stamp *before* dma to help avoid a possible race */
buffer_info->time_stamp = jiffies; buffer_info->time_stamp = jiffies;
buffer_info->dma = map + offset;
buffer_info->next_to_watch = i; buffer_info->next_to_watch = i;
buffer_info->dma = map[0] + offset;
count++;
len -= size; len -= size;
offset += size; offset += size;
count++;
i++; if (len) {
if (i == tx_ring->count) i++;
i = 0; if (i == tx_ring->count)
i = 0;
}
} }
for (f = 0; f < nr_frags; f++) { for (f = 0; f < nr_frags; f++) {
@ -3864,37 +3860,29 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
frag = &skb_shinfo(skb)->frags[f]; frag = &skb_shinfo(skb)->frags[f];
len = frag->size; len = frag->size;
map = skb_shinfo(skb)->dma_maps[f + 1];
offset = 0; offset = 0;
while (len) { while (len) {
struct e1000_buffer *buffer_info; i++;
if (i == tx_ring->count)
i = 0;
buffer_info = &tx_ring->buffer_info[i]; buffer_info = &tx_ring->buffer_info[i];
size = min(len, max_per_txd); size = min(len, max_per_txd);
buffer_info->length = size; buffer_info->length = size;
buffer_info->time_stamp = jiffies; buffer_info->time_stamp = jiffies;
buffer_info->dma = map + offset;
buffer_info->next_to_watch = i; buffer_info->next_to_watch = i;
buffer_info->dma = map[f + 1] + offset;
len -= size; len -= size;
offset += size; offset += size;
count++; count++;
i++;
if (i == tx_ring->count)
i = 0;
} }
} }
if (i == 0)
i = tx_ring->count - 1;
else
i--;
tx_ring->buffer_info[i].skb = skb; tx_ring->buffer_info[i].skb = skb;
tx_ring->buffer_info[first].next_to_watch = i; tx_ring->buffer_info[first].next_to_watch = i;
smp_wmb();
return count; return count;
} }
@ -4145,20 +4133,20 @@ static int e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
if (skb->protocol == htons(ETH_P_IP)) if (skb->protocol == htons(ETH_P_IP))
tx_flags |= E1000_TX_FLAGS_IPV4; tx_flags |= E1000_TX_FLAGS_IPV4;
/* if count is 0 then mapping error has occured */
count = e1000_tx_map(adapter, skb, first, max_per_txd, nr_frags, mss); count = e1000_tx_map(adapter, skb, first, max_per_txd, nr_frags, mss);
if (count < 0) { if (count) {
/* handle pci_map_single() error in e1000_tx_map */ e1000_tx_queue(adapter, tx_flags, count);
netdev->trans_start = jiffies;
/* Make sure there is space in the ring for the next send. */
e1000_maybe_stop_tx(netdev, MAX_SKB_FRAGS + 2);
} else {
dev_kfree_skb_any(skb); dev_kfree_skb_any(skb);
return NETDEV_TX_OK; tx_ring->buffer_info[first].time_stamp = 0;
tx_ring->next_to_use = first;
} }
e1000_tx_queue(adapter, tx_flags, count);
netdev->trans_start = jiffies;
/* Make sure there is space in the ring for the next send. */
e1000_maybe_stop_tx(netdev, MAX_SKB_FRAGS + 2);
return NETDEV_TX_OK; return NETDEV_TX_OK;
} }