* [PATCH] solos-pci: fix double-free of TX skb in DMA mode
@ 2012-12-12 0:57 David Woodhouse
2012-12-12 5:23 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: David Woodhouse @ 2012-12-12 0:57 UTC (permalink / raw)
To: netdev; +Cc: nathan
[-- Attachment #1: Type: text/plain, Size: 1234 bytes --]
We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
If there wasn't another skb ready to transmit immediately, this led to a
double-free because we'd free it *again* next time we did have a packet to
send.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Cc: stable@kernel.org
---
drivers/atm/solos-pci.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 6619a8a..c909b7b 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -945,10 +945,11 @@ static uint32_t fpga_tx(struct solos_card *card)
for (port = 0; tx_pending; tx_pending >>= 1, port++) {
if (tx_pending & 1) {
struct sk_buff *oldskb = card->tx_skb[port];
- if (oldskb)
+ if (oldskb) {
pci_unmap_single(card->dev, SKB_CB(oldskb)->dma_addr,
oldskb->len, PCI_DMA_TODEVICE);
-
+ card->tx_skb[port] = NULL;
+ }
spin_lock(&card->tx_queue_lock);
skb = skb_dequeue(&card->tx_queue[port]);
if (!skb)
--
1.8.0.1
--
David Woodhouse Open Source Technology Centre
David.Woodhouse@intel.com Intel Corporation
[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 6171 bytes --]
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] solos-pci: fix double-free of TX skb in DMA mode
2012-12-12 0:57 [PATCH] solos-pci: fix double-free of TX skb in DMA mode David Woodhouse
@ 2012-12-12 5:23 ` David Miller
2012-12-12 5:24 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2012-12-12 5:23 UTC (permalink / raw)
To: dwmw2; +Cc: netdev, nathan
From: David Woodhouse <dwmw2@infradead.org>
Date: Wed, 12 Dec 2012 00:57:14 +0000
> We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
> If there wasn't another skb ready to transmit immediately, this led to a
> double-free because we'd free it *again* next time we did have a packet to
> send.
>
> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
> Cc: stable@kernel.org
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] solos-pci: fix double-free of TX skb in DMA mode
2012-12-12 5:23 ` David Miller
@ 2012-12-12 5:24 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2012-12-12 5:24 UTC (permalink / raw)
To: dwmw2; +Cc: netdev, nathan
From: David Miller <davem@davemloft.net>
Date: Wed, 12 Dec 2012 00:23:45 -0500 (EST)
> From: David Woodhouse <dwmw2@infradead.org>
> Date: Wed, 12 Dec 2012 00:57:14 +0000
>
>> We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
>> If there wasn't another skb ready to transmit immediately, this led to a
>> double-free because we'd free it *again* next time we did have a packet to
>> send.
>>
>> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
>> Cc: stable@kernel.org
>
> Acked-by: David S. Miller <davem@davemloft.net>
Sorry, fingers slipped, I meant "Applied" :-)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-12-12 5:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-12-12 0:57 [PATCH] solos-pci: fix double-free of TX skb in DMA mode David Woodhouse
2012-12-12 5:23 ` David Miller
2012-12-12 5:24 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).