summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSaeed Bishara <saeed@marvell.com>2010-01-05 10:15:32 +0100
committerDavid S. Miller <davem@davemloft.net>2010-01-07 10:11:10 +0100
commit530e557ab268de154609f3cce2f2390e7b195af3 (patch)
treec0601d18875bfee5acd242fbc0f19cb4d6dac974
parentNET: atlx, fix memory leak (diff)
downloadlinux-530e557ab268de154609f3cce2f2390e7b195af3.tar.xz
linux-530e557ab268de154609f3cce2f2390e7b195af3.zip
mv643xx_eth: don't include cache padding in rx desc buffer size
If NET_SKB_PAD is not a multiple of the cache line size, mv643xx_eth allocates a couple of extra bytes at the start of each receive buffer to make the data payload end up on a cache line boundary. These extra bytes are skb_reserve()'d before DMA mapping, so they should not be included in the DMA map byte count (as the mapping is done starting at skb->data), nor should they be included in the receive descriptor buffer size field, or the hardware can end up DMAing beyond the end of the buffer, which can happen if someone sends us a larger-than-MTU sized packet. This problem was introduced in commit 7fd96ce47ff ("mv643xx_eth: rework receive skb cache alignment", May 6 2009), but hasn't appeared to be problematic so far, probably as the main users of mv643xx_eth all have NET_SKB_PAD == L1_CACHE_BYTES. Signed-off-by: Saeed Bishara <saeed@marvell.com> Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/mv643xx_eth.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 1405a170bb43..af67af55efe7 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -656,6 +656,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
struct sk_buff *skb;
int rx;
struct rx_desc *rx_desc;
+ int size;
skb = __skb_dequeue(&mp->rx_recycle);
if (skb == NULL)
@@ -678,10 +679,11 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
rx_desc = rxq->rx_desc_area + rx;
+ size = skb->end - skb->data;
rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
- skb->data, mp->skb_size,
+ skb->data, size,
DMA_FROM_DEVICE);
- rx_desc->buf_size = mp->skb_size;
+ rx_desc->buf_size = size;
rxq->rx_skb[rx] = skb;
wmb();
rx_desc->cmd_sts = BUFFER_OWNED_BY_DMA | RX_ENABLE_INTERRUPT;