Subject: Re: [PATCH v3] Renesas Ethernet AVB driver

From: Sergei Shtylyov <[email-masked]>
Date: Fri, 08 May 2015 00:25:36 +0300

On 05/08/2015 12:10 AM, Sergei Shtylyov wrote:

[...]

>>>>>> +    desc->ds = skb->len;
>>>>>> +    desc->dptr = dma_map_single(&ndev->dev, buffer, skb->len,
>>>>>> +                    DMA_TO_DEVICE);
>>>>>> +    if (dma_mapping_error(&ndev->dev, desc->dptr)) {
>>>>>> +        dev_kfree_skb_any(skb);
>>>>>> +        priv->tx_skb[q][entry] = NULL;

>>>>> Don't you need to make sure this NULL is properly seen by ravb_tx_free()?

>>>>     You mean doing this before releasing the spinlock? Or what?

>>> Yes, the locking your transmit function seems to open windows during
>>> which it is possible for the interrupt handler running on another CPU to
>>> mess up with the data you are using here.

>>     Will look into that too...

>     I have looked into the code and I must admit I don't understand how the
> data can be messed up with. ravb_tx_free() only advances 'priv->dirty_tx' and
> doesn't go beyond (or change) 'priv->cur_tx' which is used here...

    Nevermind, now I'm seeing the race. :-(

>>> --
>>> Florian

WBR, Sergei