25 Jun, 2009

2 commits

  • The existing code had the following race:

    Thread-1 Thread-2

    inc/read in_use
    inc/read in_use
    inc tx_free_list[qos].len
    inc tx_free_list[qos].len

    The actual in_use value was incremented twice, but thread-1 is going
    to free memory based on its stale value, and will free one too many
    times. The result is that memory is freed back to the kernel while
    its packet is still in the transmit buffer. If the memory is
    overwritten before it is transmitted, the hardware will put a valid
    checksum on it and send it out (just like it does with good packets).
    If by chance the TCP flags are clobbered but not the addresses or
    ports, the result can be a broken TCP stream.

    The fix is to track the number of freed packets in a single location
    (a Fetch-and-Add Unit register). That way it can never get out of sync
    with itself.

    We try to free up to MAX_SKB_TO_FREE (currently 10) buffers at a time.
    If fewer are available we adjust the free count with the difference.
    The action of claiming buffers to free is atomic so two threads cannot
    claim the same buffers.

    Signed-off-by: David Daney
    Signed-off-by: Ralf Baechle

    David Daney
     
  • Convert the driver to use net_device_ops as it is now mandatory.

    Also compensate for the removal of struct sk_buff's dst field.

    The changes are mostly mechanical, the content of ethernet-common.c
    was moved to ethernet.c and ethernet-common.{c,h} are removed.

    Signed-off-by: David Daney
    Signed-off-by: Ralf Baechle

    David Daney
     

23 Jun, 2009

1 commit


20 Jun, 2009

37 commits