aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Gibson <dwg@au1.ibm.com>2006-10-13 14:20:59 +1000
committerJeff Garzik <jeff@garzik.org>2006-10-21 14:34:21 -0400
commit5826cade4341a6298eb10d476dccc5f403ca7ad8 (patch)
treed5977bbf1837558b9065e5529d54cb287d056d85
parentcde49b058474ab3f7ff830283e5b538e8fbeefe5 (diff)
[PATCH] ibmveth: Fix index increment calculation
On Thu, Oct 12, 2006 at 06:22:14PM +1000, David Gibson wrote: > Your recent ibmveth commit, 751ae21c6cd1493e3d0a4935b08fb298b9d89773 > ("fix int rollover panic"), causes a rapid oops on my test machine > (POWER5 LPAR). > > I've bisected it down to that commit, but am still investigating the > cause of the crash itself. Found the problem, I believe: an object lesson in the need for great caution using ++. [...] @@ -213,6 +213,7 @@ static void ibmveth_replenish_buffer_poo } free_index = pool->consumer_index++ % pool->size; + pool->consumer_index = free_index; index = pool->free_map[free_index]; ibmveth_assert(index != IBM_VETH_INVALID_MAP); Since the ++ is used as post-increment, the increment is not included in free_index, and so the added line effectively reverts the increment. The produced_index side has an analagous bug. The following change corrects this: The recent commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773 introduced a bug in the producer/consumer index calculation in the ibmveth driver - incautious use of the post-increment ++ operator resulted in an increment being immediately reverted. This patch corrects the logic. Without this patch, the driver oopses almost immediately after activation on at least some machines. Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
-rw-r--r--drivers/net/ibmveth.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 2802db23d3c..44c9f993dcc 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -212,8 +212,8 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
break;
}
- free_index = pool->consumer_index++ % pool->size;
- pool->consumer_index = free_index;
+ free_index = pool->consumer_index;
+ pool->consumer_index = (pool->consumer_index + 1) % pool->size;
index = pool->free_map[free_index];
ibmveth_assert(index != IBM_VETH_INVALID_MAP);
@@ -329,8 +329,10 @@ static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter, u64
adapter->rx_buff_pool[pool].buff_size,
DMA_FROM_DEVICE);
- free_index = adapter->rx_buff_pool[pool].producer_index++ % adapter->rx_buff_pool[pool].size;
- adapter->rx_buff_pool[pool].producer_index = free_index;
+ free_index = adapter->rx_buff_pool[pool].producer_index;
+ adapter->rx_buff_pool[pool].producer_index
+ = (adapter->rx_buff_pool[pool].producer_index + 1)
+ % adapter->rx_buff_pool[pool].size;
adapter->rx_buff_pool[pool].free_map[free_index] = index;
mb();