lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

wimax/i2400m: fix erroneous NETDEV_TX_BUSY use

Browse Source 
A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.

In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.

In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK

Also increments tx_dropped counter

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet
2012-03-14 09:21:44 +00:00
committed by David S. Miller
parent bb6d5e76fb
commit b8fbaef586
1 changed files with 10 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
drivers/net/wimax/i2400m/netdev.c
View File

@@ -367,38 +367,28 @@ netdev_tx_t i2400m_hard_start_xmit(struct sk_buff *skb,
{ {
struct i2400m *i2400m = net_dev_to_i2400m(net_dev); struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
struct device *dev = i2400m_dev(i2400m); struct device *dev = i2400m_dev(i2400m);
int result; int result = -1;
d_fnstart(3, dev, "(skb %p net_dev %p)\n", skb, net_dev); d_fnstart(3, dev, "(skb %p net_dev %p)\n", skb, net_dev);
if (skb_header_cloned(skb)) {
/* if (skb_header_cloned(skb) &&
* Make tcpdump/wireshark happy -- if they are pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
* running, the skb is cloned and we will overwrite goto drop;
* the mac fields in i2400m_tx_prep_header. Expand
* seems to fix this...
*/
result = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
if (result) {
result = NETDEV_TX_BUSY;
goto error_expand;
}
}
if (i2400m->state == I2400M_SS_IDLE) if (i2400m->state == I2400M_SS_IDLE)
result = i2400m_net_wake_tx(i2400m, net_dev, skb); result = i2400m_net_wake_tx(i2400m, net_dev, skb);
else else
result = i2400m_net_tx(i2400m, net_dev, skb); result = i2400m_net_tx(i2400m, net_dev, skb);
if (result < 0) if (result < 0) {
drop:
net_dev->stats.tx_dropped++; net_dev->stats.tx_dropped++;
else { } else {
net_dev->stats.tx_packets++; net_dev->stats.tx_packets++;
net_dev->stats.tx_bytes += skb->len; net_dev->stats.tx_bytes += skb->len;
} }
result = NETDEV_TX_OK; dev_kfree_skb(skb);
error_expand:
kfree_skb(skb);
d_fnend(3, dev, "(skb %p net_dev %p) = %d\n", skb, net_dev, result); d_fnend(3, dev, "(skb %p net_dev %p) = %d\n", skb, net_dev, result);
return result; return NETDEV_TX_OK;
} }