net: lan78xx: Fix race in tx skb size calculation #2614
Conversation
The skb size calculation in lan78xx_tx_bh is in race with the start_xmit, which could lead to kernel oopses. So protect the whole skb walk with a spin lock. As a benefit we can unlink the skb directly. raspberrypi#2608 Signed-off-by: Floris Bos <bos@je-eigen-domein.nl> Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com> Fixes: 55d7de9 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet")
|
@lategoodbye Good work. Are you going to send this to netdev for further discussion and upstreaming? |
|
Yes, but this will happen next week. |
|
Thanks, gents. |
See: raspberrypi/linux#2614 kernel: vc4: DPI support See: raspberrypi/linux#2429 kernel: spi: Make GPIO CSs honour the SPI_NO_CS flag See: raspberrypi/linux#2169 kernel: overlays: Add addr parameter to i2c-rtc (& -gpio) See: raspberrypi/linux#2611 userland: mmal: Remove unused mmal_metadata header file
See: raspberrypi/linux#2614 kernel: vc4: DPI support See: raspberrypi/linux#2429 kernel: spi: Make GPIO CSs honour the SPI_NO_CS flag See: raspberrypi/linux#2169 kernel: overlays: Add addr parameter to i2c-rtc (& -gpio) See: raspberrypi/linux#2611 userland: mmal: Remove unused mmal_metadata header file
|
Yesterday, i sent the patch to netdev. |
|
Following on from discussion in linked thread, I seem to be seeing odd behaviour with this patch, with the unplugging of the network cable not being detected. Which makes no sense. Investigating. |
|
Some minor logging changes indicate that the lan78xx_status function is never called in the failing case., which would indicate that the interrupt over USB (intr_urb) from the lan78xx is being lost somewhere. Looking at logging in the working case, I get that 'interrupt' every time the cable is removed. However, I cannot think of a sequence invvolving that queue walk that could result in this sort of behaviour. |
|
I only want to inform you that this patch has been merged upstream and also go to stable. |
|
Thanks, Stefan. If GitHub had a Super Contributor badge you would get one. |
The skb size calculation in lan78xx_tx_bh is in race with the start_xmit,
which could lead to kernel oopses. So protect the whole skb walk with
a spin lock. As a benefit we can unlink the skb directly.
#2608