diff options
| author | Richard Cochran <richard.cochran@omicron.at> | 2011-06-21 16:00:24 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-06-21 16:00:24 -0700 |
| commit | 73151ce35bd6d56e61a87b2855193f82540bf3d3 (patch) | |
| tree | b2e1a78176025614b0a130b3ddaf37bbcc49177a | |
| parent | e00f85bec0a9924eb517ccd126ddbb9787068f53 (diff) | |
mv643xx_eth: fix race in trasmit path.
Because the socket buffer is freed in the completion interrupt, it is not
safe to access it after submitting it to the hardware.
Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/mv643xx_eth.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index a5d9b1c310b..1b7d2c1c34b 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -859,7 +859,7 @@ no_csum: static netdev_tx_t mv643xx_eth_xmit(struct sk_buff *skb, struct net_device *dev) { struct mv643xx_eth_private *mp = netdev_priv(dev); - int queue; + int length, queue; struct tx_queue *txq; struct netdev_queue *nq; @@ -881,10 +881,12 @@ static netdev_tx_t mv643xx_eth_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; } + length = skb->len; + if (!txq_submit_skb(txq, skb)) { int entries_left; - txq->tx_bytes += skb->len; + txq->tx_bytes += length; txq->tx_packets++; entries_left = txq->tx_ring_size - txq->tx_desc_count; |