From: Eric Dumazet <eric.dumazet@gmail.com>
To: Lennert Buytenhek <buytenh@wantstofly.org>
Cc: Richard Cochran <richardcochran@gmail.com>,
netdev@vger.kernel.org, David Miller <davem@davemloft.net>,
stable@kernel.org
Subject: Re: [PATCH 2/2] mv643xx_eth: fix race in trasmit path.
Date: Mon, 20 Jun 2011 19:19:10 +0200 [thread overview]
Message-ID: <1308590350.2658.6.camel@edumazet-laptop> (raw)
In-Reply-To: <20110620163316.GC994@wantstofly.org>
Le lundi 20 juin 2011 à 18:33 +0200, Lennert Buytenhek a écrit :
> On Mon, Jun 20, 2011 at 09:48:07AM +0200, Richard Cochran wrote:
>
> > Because the socket buffer is freed in the completion interrupt, it
> > is not safe to access it after submitting it to the hardware.
>
> Maybe I'm missing something here, but mv643xx_eth TX reclaim is done
> from NAPI poll, under __netif_tx_lock(), while mv643xx_eth_xmit() also
> runs under __netif_tx_lock().
See my previous answer. Its true this driver _currently_ holds tx queue
lock in its TX completion. But that might/should change.
Goal is to make tx completion not use tx queue lock in fast path, like
its done in tg3, bnx2, bnx2x ... and other recent drivers.
Its obviously correct to move skb->len access in start_xmit() before
starting the IO, even if not a bug fix, it makes all drivers behave the
same : When reviewing them, its easier not to worry about these possible
use after free.
next prev parent reply other threads:[~2011-06-20 17:19 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-20 7:48 [PATCH 0/2] fix tiny races in MAC drivers Richard Cochran
2011-06-20 7:48 ` [PATCH 1/2] pxa168_eth: fix race in transmit path Richard Cochran
2011-06-20 15:49 ` Eric Dumazet
2011-06-20 21:02 ` David Miller
2011-06-20 7:48 ` [PATCH 2/2] mv643xx_eth: fix race in trasmit path Richard Cochran
2011-06-20 14:07 ` Maxime Bizon
2011-06-20 16:31 ` Eric Dumazet
2011-06-20 15:49 ` Eric Dumazet
2011-06-20 16:33 ` Lennert Buytenhek
2011-06-20 17:19 ` Eric Dumazet [this message]
2011-06-20 17:21 ` Eric Dumazet
2011-06-21 23:00 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1308590350.2658.6.camel@edumazet-laptop \
--to=eric.dumazet@gmail.com \
--cc=buytenh@wantstofly.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=richardcochran@gmail.com \
--cc=stable@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox