qlcnic: fix rcv buffer leak
Rcv producer value should be read in spin-lock. Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
ade91f8ec9
commit
ed6f1353e1
1 changed files with 5 additions and 3 deletions
|
@ -1554,9 +1554,10 @@ qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
|
||||||
int producer, count = 0;
|
int producer, count = 0;
|
||||||
struct list_head *head;
|
struct list_head *head;
|
||||||
|
|
||||||
|
spin_lock(&rds_ring->lock);
|
||||||
|
|
||||||
producer = rds_ring->producer;
|
producer = rds_ring->producer;
|
||||||
|
|
||||||
spin_lock(&rds_ring->lock);
|
|
||||||
head = &rds_ring->free_list;
|
head = &rds_ring->free_list;
|
||||||
while (!list_empty(head)) {
|
while (!list_empty(head)) {
|
||||||
|
|
||||||
|
@ -1578,13 +1579,13 @@ qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
|
||||||
|
|
||||||
producer = get_next_index(producer, rds_ring->num_desc);
|
producer = get_next_index(producer, rds_ring->num_desc);
|
||||||
}
|
}
|
||||||
spin_unlock(&rds_ring->lock);
|
|
||||||
|
|
||||||
if (count) {
|
if (count) {
|
||||||
rds_ring->producer = producer;
|
rds_ring->producer = producer;
|
||||||
writel((producer-1) & (rds_ring->num_desc-1),
|
writel((producer-1) & (rds_ring->num_desc-1),
|
||||||
rds_ring->crb_rcv_producer);
|
rds_ring->crb_rcv_producer);
|
||||||
}
|
}
|
||||||
|
spin_unlock(&rds_ring->lock);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
@ -1596,10 +1597,11 @@ qlcnic_post_rx_buffers_nodb(struct qlcnic_adapter *adapter,
|
||||||
int producer, count = 0;
|
int producer, count = 0;
|
||||||
struct list_head *head;
|
struct list_head *head;
|
||||||
|
|
||||||
producer = rds_ring->producer;
|
|
||||||
if (!spin_trylock(&rds_ring->lock))
|
if (!spin_trylock(&rds_ring->lock))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
|
producer = rds_ring->producer;
|
||||||
|
|
||||||
head = &rds_ring->free_list;
|
head = &rds_ring->free_list;
|
||||||
while (!list_empty(head)) {
|
while (!list_empty(head)) {
|
||||||
|
|
||||||
|
|
Reference in a new issue