From 57f7a34780103bb57611eac523e9242badcc17f4 Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Wed, 4 May 2016 16:56:43 -0400 Subject: [PATCH] bnxt_en: Need memory barrier when processing the completion ring. Orabug: 23221795 The code determines if the next ring entry is valid before proceeding further to read the rest of the entry. The CPU can re-order and read the rest of the entry first, possibly reading a stale entry, if DMA of a new entry happens right after reading it. This issue can be readily seen on a ppc64 system, causing it to crash. Signed-off-by: Michael Chan Signed-off-by: David S. Miller (cherry picked from commit 67a95e2022c7f0405408fb1f910283785ece354a) Signed-off-by: Brian Maly --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 594825680711..1280b3b3679d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -1391,6 +1391,10 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) if (!TX_CMP_VALID(txcmp, raw_cons)) break; + /* The valid test of the entry must be done first before + * reading any further. + */ + rmb(); if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { tx_pkts++; /* return full budget so NAPI will complete. */ -- 2.50.1