Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik...
authorLinus Torvalds <torvalds@woody.linux-foundation.org>
Wed, 24 Jan 2007 15:42:31 +0000 (07:42 -0800)
committerLinus Torvalds <torvalds@woody.linux-foundation.org>
Wed, 24 Jan 2007 15:42:31 +0000 (07:42 -0800)
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  mv643xx_eth: Fix race condition in mv643xx_eth_free_tx_descs
  s2io bogus memset

drivers/net/mv643xx_eth.c

index c41ae4286eeae76daba0ee77bf24d08a3cbf1963..b3bf86422734a07eb7ec37da30bd1cd1acdb0b95 100644 (file)
@@ -314,6 +314,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
 
        while (mp->tx_desc_count > 0) {
                spin_lock_irqsave(&mp->lock, flags);
+
+               /* tx_desc_count might have changed before acquiring the lock */
+               if (mp->tx_desc_count <= 0) {
+                       spin_unlock_irqrestore(&mp->lock, flags);
+                       return released;
+               }
+
                tx_index = mp->tx_used_desc_q;
                desc = &mp->p_tx_desc_area[tx_index];
                cmd_sts = desc->cmd_sts;
@@ -332,13 +339,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
                if (skb)
                        mp->tx_skb[tx_index] = NULL;
 
-               spin_unlock_irqrestore(&mp->lock, flags);
-
                if (cmd_sts & ETH_ERROR_SUMMARY) {
                        printk("%s: Error in TX\n", dev->name);
                        mp->stats.tx_errors++;
                }
 
+               spin_unlock_irqrestore(&mp->lock, flags);
+
                if (cmd_sts & ETH_TX_FIRST_DESC)
                        dma_unmap_single(NULL, addr, count, DMA_TO_DEVICE);
                else