On Sat, Jan 1, 2011 at 4:02 PM, J. K. Cliburn <[email protected]> wrote:
> Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics
> message block (SMB) and coalescing message block (CMB) when adapter ring
> resources are freed.  This is desirable behavior, but, as a side effect,
> the commit leads to an oops when atl1_set_ringparam() attempts to alter
> the number of rx or tx elements in the ring buffer (by using ethtool
> -G, for example).  We don't want SMB or CMB to change during this
> operation.
>
> Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring
> parameters.
>
> Cc: [email protected]
> Signed-off-by: Jay Cliburn <[email protected]>
> Reported-by: Tõnu Raitviir <[email protected]>
> ---
>  drivers/net/atlx/atl1.c |   10 ++++++++++
>  1 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
> index 5336310..3acf512 100644
> --- a/drivers/net/atlx/atl1.c
> +++ b/drivers/net/atlx/atl1.c
> @@ -3504,6 +3504,8 @@ static int atl1_set_ringparam(struct net_device *netdev,
>        struct atl1_rfd_ring rfd_old, rfd_new;
>        struct atl1_rrd_ring rrd_old, rrd_new;
>        struct atl1_ring_header rhdr_old, rhdr_new;
> +       struct atl1_smb smb;
> +       struct atl1_cmb cmb;
>        int err;
>
>        tpd_old = adapter->tpd_ring;
> @@ -3544,11 +3546,19 @@ static int atl1_set_ringparam(struct net_device 
> *netdev,
>                adapter->rrd_ring = rrd_old;
>                adapter->tpd_ring = tpd_old;
>                adapter->ring_header = rhdr_old;
> +               /*
> +                * Save SMB and CMB, since atl1_free_ring_resources
> +                * will clear them.
> +                */
> +               smb = adapter->smb;
> +               cmb = adapter->cmb;
>                atl1_free_ring_resources(adapter);

Hum, unless I'm missing something atl1_free_ring_resources frees the
whole ring_header->dma block which contains both SMB and CMB.

>                adapter->rfd_ring = rfd_new;
>                adapter->rrd_ring = rrd_new;
>                adapter->tpd_ring = tpd_new;
>                adapter->ring_header = rhdr_new;
> +               adapter->smb = smb;
> +               adapter->cmb = cmb;

So here you're using pointers to freed memory.
In order to preserve the stats you'd have to copy the structure.

Luca

_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable

Reply via email to