netdev
[Top] [All Lists]

Re: [PATCH] forcedeth: fix random memory scribbling bug

To: Linus Torvalds <torvalds@xxxxxxxx>
Subject: Re: [PATCH] forcedeth: fix random memory scribbling bug
From: Jeff Garzik <jgarzik@xxxxxxxxx>
Date: Sat, 24 Dec 2005 16:06:02 -0500
Cc: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>, Ayaz Abdulla <AAbdulla@xxxxxxxxxx>, Linux Kernel Mailing List <linux-kernel@xxxxxxxxxxxxxxx>, Netdev <netdev@xxxxxxxxxxx>
In-reply-to: <Pine.LNX.4.64.0512241241230.14098@xxxxxxxxxxx>
References: <43AD4ADC.8050004@xxxxxxxxxxxxxxxx> <Pine.LNX.4.64.0512241145520.14098@xxxxxxxxxxx> <43ADA7D0.9010908@xxxxxxxxxxxxxxxx> <Pine.LNX.4.64.0512241241230.14098@xxxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla Thunderbird 1.0.7-1.1.fc4 (X11/20050929)
Linus Torvalds wrote:

On Sat, 24 Dec 2005, Manfred Spraul wrote:


Linus Torvalds wrote:


Of course, on the alloc path, it seems to add an additional
"NV_RX_ALLOC_PAD" thing, so maybe the "end-data" thing makes sense.

The problem is the pci_unmap_single() call that happens during nv_close() or
the rx interrupt handler. I think it makes more sense to rely on fields in the
individual skb instead of reading from np->rx_buf_sz. If np->rx_buf_sz changes
inbetween, then we have a memory leak.


Fair enough. Patch applied.

Paranoia -- the situation above never occurs. It is coded as are other drivers: np->rx_buf_sz only changes in ->change_mtu(), which (a) is serialized against close and (b) always stops the engine and drains RX skbs before changing the size.

So can we please remove the subtraction code now added to the hot path? If not now, for 2.6.16?

        Jeff




<Prev in Thread] Current Thread [Next in Thread>