summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorMatt Carlson <mcarlson@broadcom.com>2010-02-17 15:16:54 +0000
committerDavid S. Miller <davem@davemloft.net>2010-02-17 17:27:34 -0800
commit61e800cf949926b3d463ca3cf3025d964872774b (patch)
treeb855725b34c8b1f6b31b50052e2596a9797fcf96 /drivers
parent99405162598176e830d17ae6d4f3d9e070ad900c (diff)
downloadlinux-stable-61e800cf949926b3d463ca3cf3025d964872774b.tar.gz
linux-stable-61e800cf949926b3d463ca3cf3025d964872774b.tar.bz2
linux-stable-61e800cf949926b3d463ca3cf3025d964872774b.zip
tg3: Enforce DMA mapping / skb assignment ordering
Michael Chan noted that there is nothing in the code that would prevent the compiler from delaying the access of the "mapping" member of the newly arrived packet until much later. If this happened after the skb = NULL assignment, it is possible for the driver to pass a bad dma_addr value to pci_unmap_single(). To enforce this ordering, we need a write memory barrier. The pairing read memory barrier already exists in tg3_rx_prodring_xfer() under the comments starting with "Ensure that updates to the...". Signed-off-by: Matt Carlson <mcarlson@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/tg3.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 385434ff3960..344490e872b4 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4659,11 +4659,16 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
if (skb_size < 0)
goto drop_it;
- ri->skb = NULL;
-
pci_unmap_single(tp->pdev, dma_addr, skb_size,
PCI_DMA_FROMDEVICE);
+ /* Ensure that the update to the skb happens
+ * after the usage of the old DMA mapping.
+ */
+ smp_wmb();
+
+ ri->skb = NULL;
+
skb_put(skb, len);
} else {
struct sk_buff *copy_skb;