]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commitdiff
e100: Fix broken cbs accounting due to missing memset.
authorRoger Oksanen <roger.oksanen@cs.helsinki.fi>
Sat, 19 Dec 2009 04:18:21 +0000 (20:18 -0800)
committerDavid S. Miller <davem@davemloft.net>
Sat, 19 Dec 2009 04:18:21 +0000 (20:18 -0800)
Alan Stern noticed that e100 caused slab corruption.
commit 98468efddb101f8a29af974101c17ba513b07be1 changed
the allocation of cbs to use dma pools that don't return zeroed memory,
especially the cb->status field used to track which cb to clean, causing
(the visible) double freeing of skbs and a wrong free cbs count.

Now the cbs are explicitly zeroed at allocation time.

Reported-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/e100.c

index 929701ca07d31bf1aedbcb7e54a9ba93bc6db654..839fb2b136d37bd9993cbfe42d44ddcffec90e2c 100644 (file)
@@ -1829,6 +1829,7 @@ static int e100_alloc_cbs(struct nic *nic)
                                  &nic->cbs_dma_addr);
        if (!nic->cbs)
                return -ENOMEM;
+       memset(nic->cbs, 0, count * sizeof(struct cb));
 
        for (cb = nic->cbs, i = 0; i < count; cb++, i++) {
                cb->next = (i + 1 < count) ? cb + 1 : nic->cbs;
@@ -1837,7 +1838,6 @@ static int e100_alloc_cbs(struct nic *nic)
                cb->dma_addr = nic->cbs_dma_addr + i * sizeof(struct cb);
                cb->link = cpu_to_le32(nic->cbs_dma_addr +
                        ((i+1) % count) * sizeof(struct cb));
-               cb->skb = NULL;
        }
 
        nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = nic->cbs;