diff options
author | Rob Herring <rob.herring@calxeda.com> | 2013-08-30 16:49:22 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2013-09-03 22:21:15 -0400 |
commit | 1a1d4d2f30a3c7e91bb7876df95baae363be5434 (patch) | |
tree | cf305dbbc642e118d61fa13d2865ef5b3a847df7 /security | |
parent | 8746f671ef04114ab25f5a35ec6219efbdf3703e (diff) |
net: calxedaxgmac: fix possible skb free before tx complete
The TX completion code may have freed an skb before the entire sg list
was transmitted. The DMA unmap calls for the fragments could also get
skipped. Now set the skb pointer on every entry in the ring, not just
the head of the sg list. We then use the FS (first segment) bit in the
descriptors to determine skb head vs. fragment.
This also fixes similar bug in xgmac_free_tx_skbufs where clean-up of
a sg list that wraps at the end of the ring buffer would not get
unmapped.
Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions