rpms/kernel/devel linux-2.6-net-sis900-oops.patch, NONE, 1.1 kernel-2.6.spec, 1.3119, 1.3120

[fedora-cvs-commits at redhat.com]

Author: davej

Update of /cvs/dist/rpms/kernel/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv21159

Modified Files:
	kernel-2.6.spec 
Added Files:
	linux-2.6-net-sis900-oops.patch 
Log Message:
* Mon Apr 30 2007 Dave Jones <davej at redhat.com>
- Fix oops in sis900 driver.


linux-2.6-net-sis900-oops.patch:
 sis900.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

--- NEW FILE linux-2.6-net-sis900-oops.patch ---
From: Neil Horman <nhorman at tuxdriver.com>
Date: Thu, 26 Apr 2007 17:47:36 +0000 (-0400)
Subject: sis900: Allocate rx replacement buffer before rx operation
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=dc5a144991ba803bc8afded105c9db1dea0e57ab

sis900: Allocate rx replacement buffer before rx operation

Just found a hole in my last patch.  It was reported to me that shortly after we
integrated this patch.  The report was of an oops that took place inside of
netif_rx when using the sis900 driver.  Looking at my origional patch I noted
that there was a spot between the new skb_alloc and the refill_rx_ring label
where skb got reassigned to the pointer currently held in the rx_ring for the
purposes of receiveing the frame.  The result of this is however that the buffer
that gets passed to netif_rx (if it is called), then gets placed right back into
the rx_ring.  So if you receive frames fast enough the skb being processed by
the network stack can get corrupted.  The reporter is testing out the fix I've
written for this below (I'm not near my hardware at the moment to test myself),
but I wanted to post it for review ASAP.  I'll post test results when I hear
them, but I think this is a pretty straightforward fix.  It just uses a separate
pointer to do the rx operation, so that we don't improperly reassign the pointer
that we use to refill the rx ring.

Signed-off-by: Neil Horman <nhorman at tuxdriver.com>
Signed-off-by: Jeff Garzik <jeff at garzik.org>
---

diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index dea0126..2cb2e15 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -1753,6 +1753,7 @@ static int sis900_rx(struct net_device *net_dev)
 			sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE;
 		} else {
 			struct sk_buff * skb;
+			struct sk_buff * rx_skb;
 
 			pci_unmap_single(sis_priv->pci_dev,
 				sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
@@ -1786,10 +1787,10 @@ static int sis900_rx(struct net_device *net_dev)
 			}
 
 			/* give the socket buffer to upper layers */
-			skb = sis_priv->rx_skbuff[entry];
-			skb_put(skb, rx_size);
-			skb->protocol = eth_type_trans(skb, net_dev);
-			netif_rx(skb);
+			rx_skb = sis_priv->rx_skbuff[entry];
+			skb_put(rx_skb, rx_size);
+			rx_skb->protocol = eth_type_trans(rx_skb, net_dev);
+			netif_rx(rx_skb);
 
 			/* some network statistics */
 			if ((rx_status & BCAST) == MCAST)


Index: kernel-2.6.spec
===================================================================
RCS file: /cvs/dist/rpms/kernel/devel/kernel-2.6.spec,v
retrieving revision 1.3119
retrieving revision 1.3120
diff -u -r1.3119 -r1.3120
--- kernel-2.6.spec	29 Apr 2007 21:04:48 -0000	1.3119
+++ kernel-2.6.spec	30 Apr 2007 21:32:36 -0000	1.3120
@@ -557,6 +557,7 @@
 Patch1640: linux-2.6-module-override-modparam-cmdline.patch
 Patch1650: linux-2.6-serial-460800.patch
 Patch1660: linux-2.6-mm-udf-fixes.patch
+Patch1670: linux-2.6-net-sis900-oops.patch
 Patch1681: linux-2.6-xfs-umount-fix.patch
 Patch1690: linux-2.6-PT_LOAD-align.patch
 Patch1700: linux-2.6-dvb-spinlock.patch
@@ -1271,6 +1272,8 @@
 %patch1650 -p1
 # Allow large files on UDF
 %patch1660 -p1
+# Fix oops in sis900
+%patch1670 -p1
 # Fix XFS umount bug.
 %patch1681 -p1
 # Align kernel data segment to page boundary.
@@ -2334,6 +2337,9 @@
 #  - tux.
 
 %changelog
+* Mon Apr 30 2007 Dave Jones <davej at redhat.com>
+- Fix oops in sis900 driver.
+
 * Sun Apr 29 2007 Dave Jones <davej at redhat.com>
 - 2.6.21.1