net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
diff mbox series

Message ID 1453821155-27561-1-git-send-email-nschichan@freebox.fr
State New, archived
Headers show
Series
  • net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
Related show

Commit Message

Nicolas Schichan Jan. 26, 2016, 3:12 p.m. UTC
The code in txq_put_data() would use txq->tx_curr_desc to index the
tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned
fragments, which is already moved to the next descriptor at the
beginning of the function.

If that fragment was the last of the the skb, the next skb would use
that same space to place the ip headers, overwritting that small
fragment data.

Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path)
Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
---
 drivers/net/ethernet/marvell/mv643xx_eth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Philipp Kirchhofer Jan. 28, 2016, 9:12 p.m. UTC | #1
Am 26.01.2016 um 16:12 schrieb Nicolas Schichan:
> The code in txq_put_data() would use txq->tx_curr_desc to index the
> tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned
> fragments, which is already moved to the next descriptor at the
> beginning of the function.
>
> If that fragment was the last of the the skb, the next skb would use
> that same space to place the ip headers, overwritting that small
> fragment data.
>
> Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path)
> Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>

Hello Nicolas,

thanks for catching this bug. Fix is good.

Reviewed-by: Philipp Kirchhofer <philipp@familie-kirchhofer.de>

Best wishes,
   Philipp
David Miller Jan. 29, 2016, 12:08 a.m. UTC | #2
From: Nicolas Schichan <nschichan@freebox.fr>
Date: Tue, 26 Jan 2016 16:12:35 +0100

> The code in txq_put_data() would use txq->tx_curr_desc to index the
> tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned
> fragments, which is already moved to the next descriptor at the
> beginning of the function.
> 
> If that fragment was the last of the the skb, the next skb would use
> that same space to place the ip headers, overwritting that small
> fragment data.
> 
> Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path)
> Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>

Applied.

Patch
diff mbox series

diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index a0c0383..5583118 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -762,10 +762,10 @@  txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
 
 	if (length <= 8 && (uintptr_t)data & 0x7) {
 		/* Copy unaligned small data fragment to TSO header data area */
-		memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE,
+		memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE,
 		       data, length);
 		desc->buf_ptr = txq->tso_hdrs_dma
-			+ txq->tx_curr_desc * TSO_HEADER_SIZE;
+			+ tx_index * TSO_HEADER_SIZE;
 	} else {
 		/* Alignment is okay, map buffer and hand off to hardware */
 		txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;