Re: [PATCH net,stable] net: usbnet: fix SG initialisation
On Sat, Jan 11, 2014 at 6:10 AM, Bjørn Mork bj...@mork.no wrote: Commit 60e453a940ac (USBNET: fix handling padding packet) added an extra SG entry in case padding is necessary, but failed to update the initialisation of the list. This can cause list traversal to fall off the end of the list, resulting in an oops. Fixes: 60e453a940ac (USBNET: fix handling padding packet) Reported-by: Thomas Kear tho...@kear.co.nz Cc: Ming Lei ming@canonical.com Signed-off-by: Bjørn Mork bj...@mork.no --- I don't have the hardware to verify this fix. It would be good if someone could test it before it goes to stable... But in case this works, it should go into v3.12 stable. Yes, the problem can only be triggered when the zlp padding packet is needed, I remember I have a quick approach to reproduce and test the case, and I will do it when I return home tonight. Looks the fix is correct, and sorry for introducing the issue. Bjørn drivers/net/usb/usbnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 8494bb53ebdc..aba04f561760 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb) return -ENOMEM; urb-num_sgs = num_sgs; - sg_init_table(urb-sg, urb-num_sgs); + sg_init_table(urb-sg, urb-num_sgs + 1); sg_set_buf(urb-sg[s++], skb-data, skb_headlen(skb)); total_len += skb_headlen(skb); Thanks, -- Ming Lei -- To unsubscribe from this list: send the line unsubscribe linux-usb in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH net,stable] net: usbnet: fix SG initialisation
On Sat, Jan 11, 2014 at 5:16 PM, Ming Lei ming@canonical.com wrote: On Sat, Jan 11, 2014 at 6:10 AM, Bjørn Mork bj...@mork.no wrote: Commit 60e453a940ac (USBNET: fix handling padding packet) added an extra SG entry in case padding is necessary, but failed to update the initialisation of the list. This can cause list traversal to fall off the end of the list, resulting in an oops. Fixes: 60e453a940ac (USBNET: fix handling padding packet) Reported-by: Thomas Kear tho...@kear.co.nz Cc: Ming Lei ming@canonical.com Signed-off-by: Bjørn Mork bj...@mork.no Tested-by: Ming Lei ming@canonical.com On one of my arm box, I can reproduce the problem with below command every time: $iperf -c $SRV -l 2398 -n 1 #the 2nd tcp packet length is 1016 and the oops is same with Thomas's. After applying Oliver's patch, I still can see zlp padding packet is appended, but no oops any more. Thanks Oliver for fixing the problem. Thanks, -- Ming Lei -- To unsubscribe from this list: send the line unsubscribe linux-usb in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH net,stable] net: usbnet: fix SG initialisation
Commit 60e453a940ac (USBNET: fix handling padding packet) added an extra SG entry in case padding is necessary, but failed to update the initialisation of the list. This can cause list traversal to fall off the end of the list, resulting in an oops. Fixes: 60e453a940ac (USBNET: fix handling padding packet) Reported-by: Thomas Kear tho...@kear.co.nz Cc: Ming Lei ming@canonical.com Signed-off-by: Bjørn Mork bj...@mork.no --- I don't have the hardware to verify this fix. It would be good if someone could test it before it goes to stable... But in case this works, it should go into v3.12 stable. Bjørn drivers/net/usb/usbnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 8494bb53ebdc..aba04f561760 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb) return -ENOMEM; urb-num_sgs = num_sgs; - sg_init_table(urb-sg, urb-num_sgs); + sg_init_table(urb-sg, urb-num_sgs + 1); sg_set_buf(urb-sg[s++], skb-data, skb_headlen(skb)); total_len += skb_headlen(skb); -- 1.8.5.2 -- To unsubscribe from this list: send the line unsubscribe linux-usb in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
