From: David Miller <davem@davemloft.net>
To: eric.dumazet@gmail.com
Cc: christoph.paasch@uclouvain.be, Ian.Campbell@citrix.com,
sony.chacko@qlogic.com, rajesh.borundia@qlogic.com,
netdev@vger.kernel.org
Subject: Re: BUG in netxen_release_tx_buffers when TSO enabled on kernels >= 3.3 and <= 3.6
Date: Tue, 22 Jan 2013 14:15:19 -0500 (EST) [thread overview]
Message-ID: <20130122.141519.767456896436365582.davem@davemloft.net> (raw)
In-Reply-To: <1358872385.3464.3940.camel@edumazet-glaptop>
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 22 Jan 2013 08:33:05 -0800
> From: Eric Dumazet <edumazet@google.com>
...
> [PATCH] netxen: fix off by one bug in netxen_release_tx_buffer()
>
> Christoph Paasch found netxen could trigger a BUG in its dismantle
> phase, in netxen_release_tx_buffer(), using full size TSO packets.
>
> cmd_buf->frag_count includes the skb->data part, so the loop must
> start at index 1 instead of 0, or else we can make an out
> of bound access to cmd_buff->frag_array[MAX_SKB_FRAGS + 2]
>
> Christoph provided the fixes in netxen_map_tx_skb() function.
> In case of a dma mapping error, its better to clear the dma fields
> so that we don't try to unmap them again in netxen_release_tx_buffer()
>
> Reported-by: Christoph Paasch <christoph.paasch@uclouvain.be>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Tested-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Applied and queued up for -stable, thanks.
next prev parent reply other threads:[~2013-01-22 19:15 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-22 10:15 BUG in netxen_release_tx_buffers when TSO enabled on kernels >= 3.3 and <= 3.6 Christoph Paasch
2013-01-22 13:32 ` Eric Dumazet
2013-01-22 13:56 ` Eric Dumazet
2013-01-22 15:03 ` Christoph Paasch
2013-01-22 15:43 ` Christoph Paasch
2013-01-22 16:33 ` Eric Dumazet
2013-01-22 16:55 ` Christoph Paasch
2013-01-22 18:46 ` Rajesh Borundia
2013-01-22 19:15 ` David Miller [this message]
2013-01-22 19:36 ` Ben Hutchings
2013-01-22 19:59 ` Eric Dumazet
2013-01-23 19:47 ` Rajesh Borundia
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130122.141519.767456896436365582.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=Ian.Campbell@citrix.com \
--cc=christoph.paasch@uclouvain.be \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=rajesh.borundia@qlogic.com \
--cc=sony.chacko@qlogic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).