[PATCH] atl1: fix frame length bug

[PATCH] atl1: fix frame length bug

[Jay Cliburn]

The driver sets up the hardware to accept a frame with max length
equal to MTU + Ethernet header + FCS + VLAN tag, but we neglect to
add the VLAN tag size to the ingress buffer.  When a VLAN-tagged
frame arrives, the hardware passes it, but bad things happen
because the buffer is too small.  This patch fixes that.

Thanks to David Harris for reporting the bug and testing the fix.

Tested-by: David Harris <david.harris@cpni-inc.com>
Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
---
 drivers/net/atl1/atl1_main.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index 35b0a7d..9200ee5 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -120,7 +120,7 @@ static int __devinit atl1_sw_init(struct atl1_adapter *adapter)
 	struct atl1_hw *hw = &adapter->hw;
 	struct net_device *netdev = adapter->netdev;
 
-	hw->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
+	hw->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
 	hw->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
 
 	adapter->wol = 0;
@@ -688,7 +688,7 @@ static int atl1_change_mtu(struct net_device *netdev, int new_mtu)
 {
 	struct atl1_adapter *adapter = netdev_priv(netdev);
 	int old_mtu = netdev->mtu;
-	int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+	int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
 
 	if ((max_frame < ETH_ZLEN + ETH_FCS_LEN) ||
 	    (max_frame > MAX_JUMBO_FRAME_SIZE)) {
@@ -853,8 +853,8 @@ static u32 atl1_configure(struct atl1_adapter *adapter)
 	/* set Interrupt Clear Timer */
 	iowrite16(adapter->ict, hw->hw_addr + REG_CMBDISDMA_TIMER);
 
-	/* set MTU, 4 : VLAN */
-	iowrite32(hw->max_frame_size + 4, hw->hw_addr + REG_MTU);
+	/* set max frame size hw will accept */
+	iowrite32(hw->max_frame_size, hw->hw_addr + REG_MTU);
 
 	/* jumbo size & rrd retirement timer */
 	value = (((u32) hw->rx_jumbo_th & RXQ_JMBOSZ_TH_MASK)
-- 
1.5.3.7

Re: [PATCH] atl1: fix frame length bug

[Jay Cliburn]

On Mon, 14 Jan 2008 19:56:41 -0600
Jay Cliburn <jacliburn@bellsouth.net> wrote:

> The driver sets up the hardware to accept a frame with max length
> equal to MTU + Ethernet header + FCS + VLAN tag, but we neglect to
> add the VLAN tag size to the ingress buffer.  When a VLAN-tagged
> frame arrives, the hardware passes it, but bad things happen
> because the buffer is too small.  This patch fixes that.
> 
> Thanks to David Harris for reporting the bug and testing the fix.
> 
> Tested-by: David Harris <david.harris@cpni-inc.com>
> Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>

Jeff, Dave,

This bugfix needs to go in for 2.6.24 if possible.

Thanks,
Jay

Re: [PATCH] atl1: fix frame length bug

[Jay Cliburn]

On Mon, 14 Jan 2008 20:04:28 -0600
Jay Cliburn <jacliburn@bellsouth.net> wrote:

> On Mon, 14 Jan 2008 19:56:41 -0600
> Jay Cliburn <jacliburn@bellsouth.net> wrote:
> 
> > The driver sets up the hardware to accept a frame with max length
> > equal to MTU + Ethernet header + FCS + VLAN tag, but we neglect to
> > add the VLAN tag size to the ingress buffer.  When a VLAN-tagged
> > frame arrives, the hardware passes it, but bad things happen
> > because the buffer is too small.  This patch fixes that.
> > 
> > Thanks to David Harris for reporting the bug and testing the fix.
> > 
> > Tested-by: David Harris <david.harris@cpni-inc.com>
> > Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
> 
> Jeff, Dave,
> 
> This bugfix needs to go in for 2.6.24 if possible.

Dave,

I saw a message you sent awhile ago about Jeff handing off some netdev
stuff to you.  Since I haven't seen anything to rescind that notice,
I'll direct my request to you.

Could you please merge this patch for 2.6.24?
http://article.gmane.org/gmane.linux.network/83368

When the reporter hits the bug, the result is a locked up kernel.
Granted, it's triggered only in the presence of VLAN tagged frames, but
it's a serious bug and the fix is simple.

Jay

Re: [PATCH] atl1: fix frame length bug

[Jeff Garzik]

Jay Cliburn wrote:
> The driver sets up the hardware to accept a frame with max length
> equal to MTU + Ethernet header + FCS + VLAN tag, but we neglect to
> add the VLAN tag size to the ingress buffer.  When a VLAN-tagged
> frame arrives, the hardware passes it, but bad things happen
> because the buffer is too small.  This patch fixes that.
> 
> Thanks to David Harris for reporting the bug and testing the fix.
> 
> Tested-by: David Harris <david.harris@cpni-inc.com>
> Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>

applied