提交 d4ae1f5e 编写于 作者: S Stefan Raspl 提交者: David S. Miller

qeth: Fix missing pointer update

qeth_hdr_chk_and_bounce() can possibly shift the skb->data
pointer. However, the existing code didn't update the hdr pointer,
which should point to skb->data, accordingly.
Symptoms of this issue are sporadic recoveries.
Signed-off-by: NStefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: NFrank Blaschka <blaschka@linux.vnet.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 065cc782
...@@ -929,7 +929,7 @@ void qeth_core_get_drvinfo(struct net_device *, struct ethtool_drvinfo *); ...@@ -929,7 +929,7 @@ void qeth_core_get_drvinfo(struct net_device *, struct ethtool_drvinfo *);
void qeth_dbf_longtext(debug_info_t *id, int level, char *text, ...); void qeth_dbf_longtext(debug_info_t *id, int level, char *text, ...);
int qeth_core_ethtool_get_settings(struct net_device *, struct ethtool_cmd *); int qeth_core_ethtool_get_settings(struct net_device *, struct ethtool_cmd *);
int qeth_set_access_ctrl_online(struct qeth_card *card, int fallback); int qeth_set_access_ctrl_online(struct qeth_card *card, int fallback);
int qeth_hdr_chk_and_bounce(struct sk_buff *, int); int qeth_hdr_chk_and_bounce(struct sk_buff *, struct qeth_hdr **, int);
int qeth_configure_cq(struct qeth_card *, enum qeth_cq); int qeth_configure_cq(struct qeth_card *, enum qeth_cq);
int qeth_hw_trap(struct qeth_card *, enum qeth_diags_trap_action); int qeth_hw_trap(struct qeth_card *, enum qeth_diags_trap_action);
int qeth_query_ipassists(struct qeth_card *, enum qeth_prot_versions prot); int qeth_query_ipassists(struct qeth_card *, enum qeth_prot_versions prot);
......
...@@ -3717,7 +3717,7 @@ int qeth_get_elements_no(struct qeth_card *card, ...@@ -3717,7 +3717,7 @@ int qeth_get_elements_no(struct qeth_card *card,
} }
EXPORT_SYMBOL_GPL(qeth_get_elements_no); EXPORT_SYMBOL_GPL(qeth_get_elements_no);
int qeth_hdr_chk_and_bounce(struct sk_buff *skb, int len) int qeth_hdr_chk_and_bounce(struct sk_buff *skb, struct qeth_hdr **hdr, int len)
{ {
int hroom, inpage, rest; int hroom, inpage, rest;
...@@ -3730,6 +3730,8 @@ int qeth_hdr_chk_and_bounce(struct sk_buff *skb, int len) ...@@ -3730,6 +3730,8 @@ int qeth_hdr_chk_and_bounce(struct sk_buff *skb, int len)
return 1; return 1;
memmove(skb->data - rest, skb->data, skb->len - skb->data_len); memmove(skb->data - rest, skb->data, skb->len - skb->data_len);
skb->data -= rest; skb->data -= rest;
skb->tail -= rest;
*hdr = (struct qeth_hdr *)skb->data;
QETH_DBF_MESSAGE(2, "skb bounce len: %d rest: %d\n", len, rest); QETH_DBF_MESSAGE(2, "skb bounce len: %d rest: %d\n", len, rest);
} }
return 0; return 0;
......
...@@ -781,7 +781,7 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -781,7 +781,7 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
} }
if (card->info.type != QETH_CARD_TYPE_IQD) { if (card->info.type != QETH_CARD_TYPE_IQD) {
if (qeth_hdr_chk_and_bounce(new_skb, if (qeth_hdr_chk_and_bounce(new_skb, &hdr,
sizeof(struct qeth_hdr_layer2))) sizeof(struct qeth_hdr_layer2)))
goto tx_drop; goto tx_drop;
rc = qeth_do_send_packet(card, queue, new_skb, hdr, rc = qeth_do_send_packet(card, queue, new_skb, hdr,
......
...@@ -3055,7 +3055,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -3055,7 +3055,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
else else
len = sizeof(struct qeth_hdr_layer3); len = sizeof(struct qeth_hdr_layer3);
if (qeth_hdr_chk_and_bounce(new_skb, len)) if (qeth_hdr_chk_and_bounce(new_skb, &hdr, len))
goto tx_drop; goto tx_drop;
rc = qeth_do_send_packet(card, queue, new_skb, hdr, rc = qeth_do_send_packet(card, queue, new_skb, hdr,
elements_needed); elements_needed);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册