diff options
author | David Gibson <dwg@au1.ibm.com> | 2006-10-13 00:20:59 -0400 |
---|---|---|
committer | Jeff Garzik <jeff@garzik.org> | 2006-10-21 14:34:21 -0400 |
commit | 5826cade4341a6298eb10d476dccc5f403ca7ad8 (patch) | |
tree | d5977bbf1837558b9065e5529d54cb287d056d85 /drivers/net | |
parent | cde49b058474ab3f7ff830283e5b538e8fbeefe5 (diff) |
[PATCH] ibmveth: Fix index increment calculation
On Thu, Oct 12, 2006 at 06:22:14PM +1000, David Gibson wrote:
> Your recent ibmveth commit, 751ae21c6cd1493e3d0a4935b08fb298b9d89773
> ("fix int rollover panic"), causes a rapid oops on my test machine
> (POWER5 LPAR).
>
> I've bisected it down to that commit, but am still investigating the
> cause of the crash itself.
Found the problem, I believe: an object lesson in the need for great
caution using ++.
[...]
@@ -213,6 +213,7 @@ static void ibmveth_replenish_buffer_poo
}
free_index = pool->consumer_index++ % pool->size;
+ pool->consumer_index = free_index;
index = pool->free_map[free_index];
ibmveth_assert(index != IBM_VETH_INVALID_MAP);
Since the ++ is used as post-increment, the increment is not included
in free_index, and so the added line effectively reverts the
increment. The produced_index side has an analagous bug.
The following change corrects this:
The recent commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773 introduced
a bug in the producer/consumer index calculation in the ibmveth driver
- incautious use of the post-increment ++ operator resulted in an
increment being immediately reverted. This patch corrects the logic.
Without this patch, the driver oopses almost immediately after
activation on at least some machines.
Signed-off-by: David Gibson <dwg@au1.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net')
-rw-r--r-- | drivers/net/ibmveth.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c index 2802db23d3cb..44c9f993dcc4 100644 --- a/drivers/net/ibmveth.c +++ b/drivers/net/ibmveth.c | |||
@@ -212,8 +212,8 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc | |||
212 | break; | 212 | break; |
213 | } | 213 | } |
214 | 214 | ||
215 | free_index = pool->consumer_index++ % pool->size; | 215 | free_index = pool->consumer_index; |
216 | pool->consumer_index = free_index; | 216 | pool->consumer_index = (pool->consumer_index + 1) % pool->size; |
217 | index = pool->free_map[free_index]; | 217 | index = pool->free_map[free_index]; |
218 | 218 | ||
219 | ibmveth_assert(index != IBM_VETH_INVALID_MAP); | 219 | ibmveth_assert(index != IBM_VETH_INVALID_MAP); |
@@ -329,8 +329,10 @@ static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter, u64 | |||
329 | adapter->rx_buff_pool[pool].buff_size, | 329 | adapter->rx_buff_pool[pool].buff_size, |
330 | DMA_FROM_DEVICE); | 330 | DMA_FROM_DEVICE); |
331 | 331 | ||
332 | free_index = adapter->rx_buff_pool[pool].producer_index++ % adapter->rx_buff_pool[pool].size; | 332 | free_index = adapter->rx_buff_pool[pool].producer_index; |
333 | adapter->rx_buff_pool[pool].producer_index = free_index; | 333 | adapter->rx_buff_pool[pool].producer_index |
334 | = (adapter->rx_buff_pool[pool].producer_index + 1) | ||
335 | % adapter->rx_buff_pool[pool].size; | ||
334 | adapter->rx_buff_pool[pool].free_map[free_index] = index; | 336 | adapter->rx_buff_pool[pool].free_map[free_index] = index; |
335 | 337 | ||
336 | mb(); | 338 | mb(); |