summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRichard Cochran <richard.cochran@omicron.at>2011-06-22 03:00:24 +0400
committerDavid S. Miller <davem@davemloft.net>2011-06-22 03:00:24 +0400
commit73151ce35bd6d56e61a87b2855193f82540bf3d3 (patch)
treeb2e1a78176025614b0a130b3ddaf37bbcc49177a
parente00f85bec0a9924eb517ccd126ddbb9787068f53 (diff)
downloadlinux-73151ce35bd6d56e61a87b2855193f82540bf3d3.tar.xz
mv643xx_eth: fix race in trasmit path.
Because the socket buffer is freed in the completion interrupt, it is not safe to access it after submitting it to the hardware. Signed-off-by: Richard Cochran <richard.cochran@omicron.at> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/mv643xx_eth.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index a5d9b1c310b3..1b7d2c1c34b6 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -859,7 +859,7 @@ no_csum:
static netdev_tx_t mv643xx_eth_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct mv643xx_eth_private *mp = netdev_priv(dev);
- int queue;
+ int length, queue;
struct tx_queue *txq;
struct netdev_queue *nq;
@@ -881,10 +881,12 @@ static netdev_tx_t mv643xx_eth_xmit(struct sk_buff *skb, struct net_device *dev)
return NETDEV_TX_OK;
}
+ length = skb->len;
+
if (!txq_submit_skb(txq, skb)) {
int entries_left;
- txq->tx_bytes += skb->len;
+ txq->tx_bytes += length;
txq->tx_packets++;
entries_left = txq->tx_ring_size - txq->tx_desc_count;