| Message ID | 20110101090212.7149010d@osprey.hogchain.net |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: "J. K. Cliburn" <jcliburn@gmail.com> Date: Sat, 1 Jan 2011 09:02:12 -0600 > Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics > message block (SMB) and coalescing message block (CMB) when adapter ring > resources are freed. This is desirable behavior, but, as a side effect, > the commit leads to an oops when atl1_set_ringparam() attempts to alter > the number of rx or tx elements in the ring buffer (by using ethtool > -G, for example). We don't want SMB or CMB to change during this > operation. > > Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring > parameters. > > Cc: stable@kernel.org > Signed-off-by: Jay Cliburn <jcliburn@gmail.com> > Reported-by: Tõnu Raitviir <jussuf@linux.ee> I'll apply this, thanks Jay. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Sat, Jan 1, 2011 at 4:02 PM, J. K. Cliburn <jcliburn@gmail.com> wrote: > Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics > message block (SMB) and coalescing message block (CMB) when adapter ring > resources are freed. This is desirable behavior, but, as a side effect, > the commit leads to an oops when atl1_set_ringparam() attempts to alter > the number of rx or tx elements in the ring buffer (by using ethtool > -G, for example). We don't want SMB or CMB to change during this > operation. > > Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring > parameters. > > Cc: stable@kernel.org > Signed-off-by: Jay Cliburn <jcliburn@gmail.com> > Reported-by: Tõnu Raitviir <jussuf@linux.ee> > --- > drivers/net/atlx/atl1.c | 10 ++++++++++ > 1 files changed, 10 insertions(+), 0 deletions(-) > > diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c > index 5336310..3acf512 100644 > --- a/drivers/net/atlx/atl1.c > +++ b/drivers/net/atlx/atl1.c > @@ -3504,6 +3504,8 @@ static int atl1_set_ringparam(struct net_device *netdev, > struct atl1_rfd_ring rfd_old, rfd_new; > struct atl1_rrd_ring rrd_old, rrd_new; > struct atl1_ring_header rhdr_old, rhdr_new; > + struct atl1_smb smb; > + struct atl1_cmb cmb; > int err; > > tpd_old = adapter->tpd_ring; > @@ -3544,11 +3546,19 @@ static int atl1_set_ringparam(struct net_device *netdev, > adapter->rrd_ring = rrd_old; > adapter->tpd_ring = tpd_old; > adapter->ring_header = rhdr_old; > + /* > + * Save SMB and CMB, since atl1_free_ring_resources > + * will clear them. > + */ > + smb = adapter->smb; > + cmb = adapter->cmb; > atl1_free_ring_resources(adapter); Hum, unless I'm missing something atl1_free_ring_resources frees the whole ring_header->dma block which contains both SMB and CMB. > adapter->rfd_ring = rfd_new; > adapter->rrd_ring = rrd_new; > adapter->tpd_ring = tpd_new; > adapter->ring_header = rhdr_new; > + adapter->smb = smb; > + adapter->cmb = cmb; So here you're using pointers to freed memory. In order to preserve the stats you'd have to copy the structure. Luca -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Jan 5, 2011 at 4:42 PM, Luca Tettamanti <kronos.it@gmail.com> wrote: > So here you're using pointers to freed memory. > In order to preserve the stats you'd have to copy the structure. Doh. I still haven't recovered from all the partying ;-) Sorry for the noise... L -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c index 5336310..3acf512 100644 --- a/drivers/net/atlx/atl1.c +++ b/drivers/net/atlx/atl1.c @@ -3504,6 +3504,8 @@ static int atl1_set_ringparam(struct net_device *netdev, struct atl1_rfd_ring rfd_old, rfd_new; struct atl1_rrd_ring rrd_old, rrd_new; struct atl1_ring_header rhdr_old, rhdr_new; + struct atl1_smb smb; + struct atl1_cmb cmb; int err; tpd_old = adapter->tpd_ring; @@ -3544,11 +3546,19 @@ static int atl1_set_ringparam(struct net_device *netdev, adapter->rrd_ring = rrd_old; adapter->tpd_ring = tpd_old; adapter->ring_header = rhdr_old; + /* + * Save SMB and CMB, since atl1_free_ring_resources + * will clear them. + */ + smb = adapter->smb; + cmb = adapter->cmb; atl1_free_ring_resources(adapter); adapter->rfd_ring = rfd_new; adapter->rrd_ring = rrd_new; adapter->tpd_ring = tpd_new; adapter->ring_header = rhdr_new; + adapter->smb = smb; + adapter->cmb = cmb; err = atl1_up(adapter); if (err)
Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics message block (SMB) and coalescing message block (CMB) when adapter ring resources are freed. This is desirable behavior, but, as a side effect, the commit leads to an oops when atl1_set_ringparam() attempts to alter the number of rx or tx elements in the ring buffer (by using ethtool -G, for example). We don't want SMB or CMB to change during this operation. Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring parameters. Cc: stable@kernel.org Signed-off-by: Jay Cliburn <jcliburn@gmail.com> Reported-by: Tõnu Raitviir <jussuf@linux.ee> --- drivers/net/atlx/atl1.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)