On 05/08/2015 12:10 AM, Sergei Shtylyov wrote:
[...]
+ desc->ds = skb->len;
+ desc->dptr = dma_map_single(&ndev->dev, buffer, skb->len,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(&ndev->dev, desc->dptr)) {
+ dev_kfree_skb_any(skb);
+ priv->tx_skb[q][entry] = NULL;
Don't you need to make sure this NULL is properly seen by ravb_tx_free()?
You mean doing this before releasing the spinlock? Or what?
Yes, the locking your transmit function seems to open windows during
which it is possible for the interrupt handler running on another CPU to
mess up with the data you are using here.
Will look into that too...
I have looked into the code and I must admit I don't understand how the
data can be messed up with. ravb_tx_free() only advances 'priv->dirty_tx' and
doesn't go beyond (or change) 'priv->cur_tx' which is used here...
Nevermind, now I'm seeing the race. :-(
--
Florian
WBR, Sergei
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
