tg3: fix tigon3_dma_hwbug_workaround()

Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3:
enable transmit time stamping."

This is because tigon3_dma_hwbug_workaround() might alloc a new skb and
free the original. We panic when skb_tx_timestamp() is called on freed
skb.

Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com>
(cherry picked from commit f7ff19871bb4a3451e1ca2cf660bf633018cfbec)
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joe Jin <joe.jin@oracle.com>

diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 06f66eca57a1f5e2835cd81751a9af4a2d4e0a5e..77adaf4ec4646bbff587e2b8a4153db9b0656f25 100644 (file)
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -6535,12 +6535,12 @@ static void tg3_tx_skb_unmap(struct tg3_napi *tnapi, u32 entry, int last)
 
 /* Workaround 4GB and 40-bit hardware DMA bugs. */
 static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
-                                      struct sk_buff *skb,
+                                      struct sk_buff **pskb,
                                       u32 *entry, u32 *budget,
                                       u32 base_flags, u32 mss, u32 vlan)
 {
        struct tg3 *tp = tnapi->tp;
-       struct sk_buff *new_skb;
+       struct sk_buff *new_skb, *skb = *pskb;
        dma_addr_t new_addr = 0;
        int ret = 0;
 
@@ -6582,7 +6582,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
        }
 
        dev_kfree_skb(skb);
-
+       *pskb = new_skb;
        return ret;
 }
 
@@ -6813,7 +6813,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 */
                entry = tnapi->tx_prod;
                budget = tg3_tx_avail(tnapi);
-               if (tigon3_dma_hwbug_workaround(tnapi, skb, &entry, &budget,
+               if (tigon3_dma_hwbug_workaround(tnapi, &skb, &entry, &budget,
                                                base_flags, mss, vlan))
                        goto out_unlock;
        }