netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] usbnet: Fix dma setup for fragmented packets that need a pad byte appended.
@ 2014-01-14 11:16 David Laight
  2014-01-14 14:41 ` Eric Dumazet
  0 siblings, 1 reply; 6+ messages in thread
From: David Laight @ 2014-01-14 11:16 UTC (permalink / raw)
  To: netdev

If the usbnet code appends a byte to a fragmented packet (in order to avoid
sending a bulk data message that is a multiple of the USB message size) then
the scatter-gather list isn't initialised correctly.
This causes a later panic in usb_hcd_map_urb_for_dma().
Basically when the code tries to access the final sg fragment the sg function
returns NULL because the 'end of sg list' market is set in the previous one.

Bug introduced in commit 60e453a940ac678565b6641d65f8c18541bb9f28
(USBNET: fix handling padding packet) and needs applying to all
kernels that contain this change (including 3.12).

Fix from Bjorn Mork.

Signed-off-by: David Laight <david.laight@aculab.com>
---

I think it is ok that the sg table's last element is never assigned to when
the packet isn't padded.

 drivers/net/usb/usbnet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 8494bb5..aba04f5 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
 		return -ENOMEM;
 
 	urb->num_sgs = num_sgs;
-	sg_init_table(urb->sg, urb->num_sgs);
+	sg_init_table(urb->sg, urb->num_sgs + 1);
 
 	sg_set_buf(&urb->sg[s++], skb->data, skb_headlen(skb));
 	total_len += skb_headlen(skb);
-- 
1.8.1.2

^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2014-01-14 18:51 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-14 11:16 [PATCH] usbnet: Fix dma setup for fragmented packets that need a pad byte appended David Laight
2014-01-14 14:41 ` Eric Dumazet
2014-01-14 14:48   ` David Laight
2014-01-14 15:48     ` Bjørn Mork
2014-01-14 17:28       ` David Laight
2014-01-14 18:51         ` Bjørn Mork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).