Commit 22527864 authored by Dhananjay Phadke's avatar Dhananjay Phadke Committed by David S. Miller
Browse files

netxen: fix race in tx ring acccess



Fix the distance check between tx ring producer and consumer that
could lead to tx ring wrap around.
Signed-off-by: default avatarDhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 78a658d9
...@@ -526,7 +526,7 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter, ...@@ -526,7 +526,7 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
producer = tx_ring->producer; producer = tx_ring->producer;
consumer = tx_ring->sw_consumer; consumer = tx_ring->sw_consumer;
if (nr_desc > find_diff_among(producer, consumer, tx_ring->num_desc)) { if (nr_desc >= find_diff_among(producer, consumer, tx_ring->num_desc)) {
netif_tx_unlock_bh(adapter->netdev); netif_tx_unlock_bh(adapter->netdev);
return -EBUSY; return -EBUSY;
} }
...@@ -752,7 +752,7 @@ int netxen_linkevent_request(struct netxen_adapter *adapter, int enable) ...@@ -752,7 +752,7 @@ int netxen_linkevent_request(struct netxen_adapter *adapter, int enable)
word = NX_NIC_H2C_OPCODE_GET_LINKEVENT | ((u64)adapter->portnum << 16); word = NX_NIC_H2C_OPCODE_GET_LINKEVENT | ((u64)adapter->portnum << 16);
req.req_hdr = cpu_to_le64(word); req.req_hdr = cpu_to_le64(word);
req.words[0] = cpu_to_le64(enable); req.words[0] = cpu_to_le64(enable | (enable << 8));
rv = netxen_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1); rv = netxen_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
if (rv != 0) { if (rv != 0) {
......
...@@ -1319,10 +1319,11 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter) ...@@ -1319,10 +1319,11 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
break; break;
} }
if (count) { tx_ring->sw_consumer = sw_consumer;
tx_ring->sw_consumer = sw_consumer;
if (count && netif_running(netdev)) {
smp_mb(); smp_mb();
if (netif_queue_stopped(netdev) && netif_running(netdev)) { if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev)) {
netif_tx_lock(netdev); netif_tx_lock(netdev);
netif_wake_queue(netdev); netif_wake_queue(netdev);
smp_mb(); smp_mb();
...@@ -1450,7 +1451,6 @@ netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter, ...@@ -1450,7 +1451,6 @@ netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter,
rds_ring->producer = producer; rds_ring->producer = producer;
NXWR32(adapter, rds_ring->crb_rcv_producer, NXWR32(adapter, rds_ring->crb_rcv_producer,
(producer - 1) & (rds_ring->num_desc - 1)); (producer - 1) & (rds_ring->num_desc - 1));
wmb();
} }
spin_unlock(&rds_ring->lock); spin_unlock(&rds_ring->lock);
} }
......
...@@ -809,6 +809,7 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev) ...@@ -809,6 +809,7 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
{ {
netif_carrier_off(netdev); netif_carrier_off(netdev);
netif_stop_queue(netdev); netif_stop_queue(netdev);
smp_mb();
netxen_napi_disable(adapter); netxen_napi_disable(adapter);
if (adapter->stop_port) if (adapter->stop_port)
...@@ -1340,7 +1341,7 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) ...@@ -1340,7 +1341,7 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
producer = tx_ring->producer; producer = tx_ring->producer;
smp_mb(); smp_mb();
consumer = tx_ring->sw_consumer; consumer = tx_ring->sw_consumer;
if ((no_of_desc+2) > find_diff_among(producer, consumer, num_txd)) { if ((no_of_desc+2) >= find_diff_among(producer, consumer, num_txd)) {
netif_stop_queue(netdev); netif_stop_queue(netdev);
smp_mb(); smp_mb();
return NETDEV_TX_BUSY; return NETDEV_TX_BUSY;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment