[Intel-wired-lan] [Next PATCH] e1000: fix data race between tx_ring->next_to_clean
Brown, Aaron F
aaron.f.brown at intel.com
Fri Nov 20 04:09:16 UTC 2015
> e1000_clean_tx_irq cleans buffers and sets tx_ring->next_to_clean,
> then e1000_xmit_frame reuses the cleaned buffers. But there are no
> memory barriers when buffers gets recycled, so the recycled buffers
> can be corrupted.
>
> Use smp_store_release to update tx_ring->next_to_clean and
> smp_load_acquire to read tx_ring->next_to_clean to properly
> hand off buffers from e1000_clean_tx_irq to e1000_xmit_frame.
>
> The data race was found with KernelThreadSanitizer (KTSAN).
>
> Signed-off-by: Dmitry Vyukov <dvyukov at google.com>
> ---
> drivers/net/ethernet/intel/e1000/e1000.h | 7 +++++--
> drivers/net/ethernet/intel/e1000/e1000_main.c | 5 ++++-
> 2 files changed, 9 insertions(+), 3 deletions(-)
Tested-by: Aaron Brown <aaron.f.brown at intel.com>
More information about the Intel-wired-lan
mailing list