Commit 07ac3e70 authored by David L Stevens's avatar David L Stevens Committed by David S. Miller

sunvnet: free pending tx buffers before clearing ring data

This patch moves the clearing of ring data in vnet_port_free_tx_bufs to after
 the freeing of pending buffers in the ring. Otherwise, this can result in
 dereferencing a NULL pointer.
Reported-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: default avatarDavid L Stevens <david.stevens@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 971f49de
...@@ -1637,16 +1637,9 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port) ...@@ -1637,16 +1637,9 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
int i; int i;
dr = &port->vio.drings[VIO_DRIVER_TX_RING]; dr = &port->vio.drings[VIO_DRIVER_TX_RING];
if (dr->base) {
ldc_free_exp_dring(port->vio.lp, dr->base, if (dr->base == NULL)
(dr->entry_size * dr->num_entries), return;
dr->cookies, dr->ncookies);
dr->base = NULL;
dr->entry_size = 0;
dr->num_entries = 0;
dr->pending = 0;
dr->ncookies = 0;
}
for (i = 0; i < VNET_TX_RING_SIZE; i++) { for (i = 0; i < VNET_TX_RING_SIZE; i++) {
struct vio_net_desc *d; struct vio_net_desc *d;
...@@ -1666,6 +1659,14 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port) ...@@ -1666,6 +1659,14 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
port->tx_bufs[i].skb = NULL; port->tx_bufs[i].skb = NULL;
d->hdr.state = VIO_DESC_FREE; d->hdr.state = VIO_DESC_FREE;
} }
ldc_free_exp_dring(port->vio.lp, dr->base,
(dr->entry_size * dr->num_entries),
dr->cookies, dr->ncookies);
dr->base = NULL;
dr->entry_size = 0;
dr->num_entries = 0;
dr->pending = 0;
dr->ncookies = 0;
} }
static int vnet_port_alloc_tx_ring(struct vnet_port *port) static int vnet_port_alloc_tx_ring(struct vnet_port *port)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment