Skip to content
  • Neil Horman's avatar
    sis900: Allocate rx replacement buffer before rx operation · dc5a1449
    Neil Horman authored
    
    
    Just found a hole in my last patch.  It was reported to me that shortly after we
    integrated this patch.  The report was of an oops that took place inside of
    netif_rx when using the sis900 driver.  Looking at my origional patch I noted
    that there was a spot between the new skb_alloc and the refill_rx_ring label
    where skb got reassigned to the pointer currently held in the rx_ring for the
    purposes of receiveing the frame.  The result of this is however that the buffer
    that gets passed to netif_rx (if it is called), then gets placed right back into
    the rx_ring.  So if you receive frames fast enough the skb being processed by
    the network stack can get corrupted.  The reporter is testing out the fix I've
    written for this below (I'm not near my hardware at the moment to test myself),
    but I wanted to post it for review ASAP.  I'll post test results when I hear
    them, but I think this is a pretty straightforward fix.  It just uses a separate
    pointer to do the rx operation, so that we don't improperly reassign the pointer
    that we use to refill the rx ring.
    
    Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
    Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
    dc5a1449