summaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorNicolas Schichan <nschichan@freebox.fr>2016-01-26 16:12:35 +0100
committerDavid S. Miller <davem@davemloft.net>2016-01-29 01:08:01 +0100
commit3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 (patch)
treeb8e29ea210b3322e91e5de52a844a5681589ee89 /drivers/net
parentof: of_mdio: Ensure mdio device is a PHY (diff)
downloadlinux-3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8.tar.xz
linux-3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8.zip
net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
The code in txq_put_data() would use txq->tx_curr_desc to index the tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned fragments, which is already moved to the next descriptor at the beginning of the function. If that fragment was the last of the the skb, the next skb would use that same space to place the ip headers, overwritting that small fragment data. Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path) Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Reviewed-by: Philipp Kirchhofer <philipp@familie-kirchhofer.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/ethernet/marvell/mv643xx_eth.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index a0c03834a2f7..55831188bc32 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
if (length <= 8 && (uintptr_t)data & 0x7) {
/* Copy unaligned small data fragment to TSO header data area */
- memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE,
+ memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE,
data, length);
desc->buf_ptr = txq->tso_hdrs_dma
- + txq->tx_curr_desc * TSO_HEADER_SIZE;
+ + tx_index * TSO_HEADER_SIZE;
} else {
/* Alignment is okay, map buffer and hand off to hardware */
txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;