[NET]: Fix NAPI completion handling in some drivers.

In order for the list handling in net_rx_action() to be
correct, drivers must follow certain rules as stated by
this comment in net_rx_action():

		/* Drivers must not modify the NAPI state if they
		 * consume the entire weight.  In such cases this code
		 * still "owns" the NAPI instance and therefore can
		 * move the instance around on the list at-will.
		 */

A few drivers do not do this because they mix the budget checks
with reading hardware state, resulting in crashes like the one
reported by takano@axe-inc.co.jp.

BNX2 and TG3 are taken care of here, SKY2 fix is from Stephen
Hemminger.

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 13 insertions, 4 deletions

diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index fe0e7560d236..4e569fa0f96c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -2606,7 +2606,7 @@ static int sky2_poll(struct napi_struct *napi, int work_limit)
 {
         struct sky2_hw *hw = container_of(napi, struct sky2_hw, napi);
         u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
-        int work_done;
+        int work_done = 0;
 
         if (unlikely(status & Y2_IS_ERROR))
                 sky2_err_intr(hw, status);
@@ -2617,10 +2617,16 @@ static int sky2_poll(struct napi_struct *napi, int work_limit)
         if (status & Y2_IS_IRQ_PHY2)
                 sky2_phy_intr(hw, 1);
 
-        work_done = sky2_status_intr(hw, work_limit);
+        for(;;) {
+                work_done += sky2_status_intr(hw, work_limit);
+
+                if (work_done >= work_limit)
+                        break;
+
+                /* More work? */
+                if (hw->st_idx != sky2_read16(hw, STAT_PUT_IDX))
+                        continue;
 
-        /* More work? */
-        if (hw->st_idx == sky2_read16(hw, STAT_PUT_IDX)) {
                 /* Bug/Errata workaround?
                  * Need to kick the TX irq moderation timer.
                  */
@@ -2631,7 +2637,10 @@ static int sky2_poll(struct napi_struct *napi, int work_limit)
 
                 napi_complete(napi);
                 sky2_read32(hw, B0_Y2_SP_LISR);
+                break;
+
         }
+
         return work_done;
 }