diff options
| author |   Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> | 2016-03-08 01:37:09 +0300 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2016-03-10 16:06:49 -0500 |
| commit | d0ba913488dc8c55d1880f5ed34f096dc45fb05d (patch) | |
| tree | fcd16efd2a857d1a8ceb31f9fe92a8f9bc1ecb22 /drivers | |
| parent | sh_eth: fix NULL pointer dereference in sh_eth_ring_format() (diff) | |
| download | linux-dev-d0ba913488dc8c55d1880f5ed34f096dc45fb05d.tar.xz linux-dev-d0ba913488dc8c55d1880f5ed34f096dc45fb05d.zip | |
sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
Iff dma_map_single() fails, 'rxdesc' should point to the last filled RX
descriptor, so that it can be marked as the last one, however the driver
would have already advanced it by that time. In order to fix that, only
fill an RX descriptor once all the data for it is ready.
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ethernet/renesas/sh_eth.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c index 6fb75a1d68b9..2e9a78164054 100644 --- a/drivers/net/ethernet/renesas/sh_eth.c +++ b/drivers/net/ethernet/renesas/sh_eth.c @@ -1127,11 +1127,8 @@ static void sh_eth_ring_format(struct net_device *ndev) break; sh_eth_set_receive_align(skb); - /* RX descriptor */ - rxdesc = &mdp->rx_ring[i]; /* The size of the buffer is a multiple of 32 bytes. */ buf_len = ALIGN(mdp->rx_buf_sz, 32); - rxdesc->len = cpu_to_le32(buf_len << 16); dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len, DMA_FROM_DEVICE); if (dma_mapping_error(&ndev->dev, dma_addr)) { @@ -1139,6 +1136,10 @@ static void sh_eth_ring_format(struct net_device *ndev) break; } mdp->rx_skbuff[i] = skb; + + /* RX descriptor */ + rxdesc = &mdp->rx_ring[i]; + rxdesc->len = cpu_to_le32(buf_len << 16); rxdesc->addr = cpu_to_le32(dma_addr); rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP); |