mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 09:50:04 +00:00
a620c16326
The existing code had the following race:
Thread-1 Thread-2
inc/read in_use
inc/read in_use
inc tx_free_list[qos].len
inc tx_free_list[qos].len
The actual in_use value was incremented twice, but thread-1 is going
to free memory based on its stale value, and will free one too many
times. The result is that memory is freed back to the kernel while
its packet is still in the transmit buffer. If the memory is
overwritten before it is transmitted, the hardware will put a valid
checksum on it and send it out (just like it does with good packets).
If by chance the TCP flags are clobbered but not the addresses or
ports, the result can be a broken TCP stream.
The fix is to track the number of freed packets in a single location
(a Fetch-and-Add Unit register). That way it can never get out of sync
with itself.
We try to free up to MAX_SKB_TO_FREE (currently 10) buffers at a time.
If fewer are available we adjust the free count with the difference.
The action of claiming buffers to free is atomic so two threads cannot
claim the same buffers.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
57 lines
2 KiB
C
57 lines
2 KiB
C
/*********************************************************************
|
|
* Author: Cavium Networks
|
|
*
|
|
* Contact: support@caviumnetworks.com
|
|
* This file is part of the OCTEON SDK
|
|
*
|
|
* Copyright (c) 2003-2007 Cavium Networks
|
|
*
|
|
* This file is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License, Version 2, as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This file is distributed in the hope that it will be useful, but
|
|
* AS-IS and WITHOUT ANY WARRANTY; without even the implied warranty
|
|
* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE, TITLE, or
|
|
* NONINFRINGEMENT. See the GNU General Public License for more
|
|
* details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this file; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
* or visit http://www.gnu.org/licenses/.
|
|
*
|
|
* This file may also be available under a different license from Cavium.
|
|
* Contact Cavium Networks for more information
|
|
*********************************************************************/
|
|
|
|
int cvm_oct_xmit(struct sk_buff *skb, struct net_device *dev);
|
|
int cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev);
|
|
int cvm_oct_transmit_qos(struct net_device *dev, void *work_queue_entry,
|
|
int do_free, int qos);
|
|
void cvm_oct_tx_shutdown(struct net_device *dev);
|
|
|
|
/**
|
|
* Free dead transmit skbs.
|
|
*
|
|
* @priv: The driver data
|
|
* @skb_to_free: The number of SKBs to free (free none if negative).
|
|
* @qos: The queue to free from.
|
|
* @take_lock: If true, acquire the skb list lock.
|
|
*/
|
|
static inline void cvm_oct_free_tx_skbs(struct octeon_ethernet *priv,
|
|
int skb_to_free,
|
|
int qos, int take_lock)
|
|
{
|
|
/* Free skbuffs not in use by the hardware. */
|
|
if (skb_to_free > 0) {
|
|
if (take_lock)
|
|
spin_lock(&priv->tx_free_list[qos].lock);
|
|
while (skb_to_free > 0) {
|
|
dev_kfree_skb(__skb_dequeue(&priv->tx_free_list[qos]));
|
|
skb_to_free--;
|
|
}
|
|
if (take_lock)
|
|
spin_unlock(&priv->tx_free_list[qos].lock);
|
|
}
|
|
}
|