Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=faac9c4b753f420c02bdce0785d2657087830a12
Commit:     faac9c4b753f420c02bdce0785d2657087830a12
Parent:     a3d384029aa304f8f3f5355d35f0ae274454f7cd
Author:     Michael Chan <[EMAIL PROTECTED]>
AuthorDate: Thu Dec 14 15:56:32 2006 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Sun Dec 17 21:59:15 2006 -0800

    [BNX2]: Fix panic in bnx2_tx_int().
    
    There was an off-by-one bug in bnx2_tx_avail().  If the tx ring is
    completely full, the producer and consumer indices may be apart by
    256 even though the ring size is only 255.  One entry in the ring is
    unused and must be properly accounted for when calculating the number
    of available entries.  The bug caused the tx ring entries to be
    reused by mistake, overwriting active entries, and ultimately causing
    it to crash.
    
    This bug rarely occurs because the tx ring is rarely completely full.
    We always stop when there is less than MAX_SKB_FRAGS entries available
    in the ring.
    
    Thanks to Corey Kovacs <[EMAIL PROTECTED]> and Andy Gospodarek
    <[EMAIL PROTECTED]> for reporting the problem and helping to collect
    debug information.
    
    Signed-off-by: Michael Chan <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 drivers/net/bnx2.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 7d824cf..f296c37 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -217,9 +217,16 @@ static inline u32 bnx2_tx_avail(struct bnx2 *bp)
        u32 diff;
 
        smp_mb();
-       diff = TX_RING_IDX(bp->tx_prod) - TX_RING_IDX(bp->tx_cons);
-       if (diff > MAX_TX_DESC_CNT)
-               diff = (diff & MAX_TX_DESC_CNT) - 1;
+
+       /* The ring uses 256 indices for 255 entries, one of them
+        * needs to be skipped.
+        */
+       diff = bp->tx_prod - bp->tx_cons;
+       if (unlikely(diff >= TX_DESC_CNT)) {
+               diff &= 0xffff;
+               if (diff == TX_DESC_CNT)
+                       diff = MAX_TX_DESC_CNT;
+       }
        return (bp->tx_ring_size - diff);
 }
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to