Commit:     dc5a144991ba803bc8afded105c9db1dea0e57ab
Parent:     1764f15016fea54db723a96234a82646dac9a036
Author:     Neil Horman <[EMAIL PROTECTED]>
AuthorDate: Thu Apr 26 13:47:36 2007 -0400
Committer:  Jeff Garzik <[EMAIL PROTECTED]>
CommitDate: Fri Apr 27 20:16:41 2007 -0400

    sis900: Allocate rx replacement buffer before rx operation
    Just found a hole in my last patch.  It was reported to me that shortly 
after we
    integrated this patch.  The report was of an oops that took place inside of
    netif_rx when using the sis900 driver.  Looking at my origional patch I 
    that there was a spot between the new skb_alloc and the refill_rx_ring label
    where skb got reassigned to the pointer currently held in the rx_ring for 
    purposes of receiveing the frame.  The result of this is however that the 
    that gets passed to netif_rx (if it is called), then gets placed right back 
    the rx_ring.  So if you receive frames fast enough the skb being processed 
    the network stack can get corrupted.  The reporter is testing out the fix 
    written for this below (I'm not near my hardware at the moment to test 
    but I wanted to post it for review ASAP.  I'll post test results when I hear
    them, but I think this is a pretty straightforward fix.  It just uses a 
    pointer to do the rx operation, so that we don't improperly reassign the 
    that we use to refill the rx ring.
    Signed-off-by: Neil Horman <[EMAIL PROTECTED]>
    Signed-off-by: Jeff Garzik <[EMAIL PROTECTED]>
 drivers/net/sis900.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index dea0126..2cb2e15 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -1753,6 +1753,7 @@ static int sis900_rx(struct net_device *net_dev)
                        sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE;
                } else {
                        struct sk_buff * skb;
+                       struct sk_buff * rx_skb;
                                sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
@@ -1786,10 +1787,10 @@ static int sis900_rx(struct net_device *net_dev)
                        /* give the socket buffer to upper layers */
-                       skb = sis_priv->rx_skbuff[entry];
-                       skb_put(skb, rx_size);
-                       skb->protocol = eth_type_trans(skb, net_dev);
-                       netif_rx(skb);
+                       rx_skb = sis_priv->rx_skbuff[entry];
+                       skb_put(rx_skb, rx_size);
+                       rx_skb->protocol = eth_type_trans(rx_skb, net_dev);
+                       netif_rx(rx_skb);
                        /* some network statistics */
                        if ((rx_status & BCAST) == MCAST)
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to