net: hns3: fix desc filling bug when skb is expanded or lineared (cfdaeba5) · Commits · 戴 / test

The linear and frag data part may be changed when the skb is expanded or lineared in skb_cow_head() or skb_checksum_help(), which is called by hns3_fill_skb_desc(), so the linear len return by skb_headlen() before the calling of hns3_fill_skb_desc() is unreliable. Move hns3_fill_skb_desc() before the calling of skb_headlen() to fix this bug. Fixes: ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by:

Yunsheng Lin <linyunsheng@huawei.com> Signed-off-by:

Huazhong Tan <tanhuazhong@huawei.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c

+6 −10

Original line number	Diff line number	Diff line
		@@ -1093,16 +1093,8 @@ static int hns3_fill_desc(struct hns3_enet_ring ring, void priv,
		int k, sizeoflast;
		dma_addr_t dma;

		if (type == DESC_TYPE_SKB) {
		struct sk_buff skb = (struct sk_buff )priv;
		int ret;

		ret = hns3_fill_skb_desc(ring, skb, desc);
		if (unlikely(ret < 0))
		return ret;

		dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
		} else if (type == DESC_TYPE_FRAGLIST_SKB) {
		if (type == DESC_TYPE_FRAGLIST_SKB \|\|
		type == DESC_TYPE_SKB) {
		struct sk_buff skb = (struct sk_buff )priv;

		dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
		@@ -1439,6 +1431,10 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff skb, struct net_device netdev)

		next_to_use_head = ring->next_to_use;

		ret = hns3_fill_skb_desc(ring, skb, &ring->desc[ring->next_to_use]);
		if (unlikely(ret < 0))
		goto fill_err;

		ret = hns3_fill_skb_to_desc(ring, skb, DESC_TYPE_SKB);
		if (unlikely(ret < 0))
		goto fill_err;

Admin message