sfc: Copy RX prefix into skb head area in efx_rx_mk_skb()
We can potentially pull the entire packet contents into the head area and then free the page it was in. In order to read an inline timestamp safely, we need to copy the prefix into the head area as well. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
This commit is contained in:
parent
9ec0659595
commit
2ccd0b1925
|
@ -521,15 +521,6 @@ enum nic_state {
|
|||
STATE_RECOVERY = 3, /* device recovering from PCI error */
|
||||
};
|
||||
|
||||
/*
|
||||
* Alignment of the skb->head which wraps a page-allocated RX buffer
|
||||
*
|
||||
* The skb allocated to wrap an rx_buffer can have this alignment. Since
|
||||
* the data is memcpy'd from the rx_buf, it does not need to be equal to
|
||||
* NET_IP_ALIGN.
|
||||
*/
|
||||
#define EFX_PAGE_SKB_ALIGN 2
|
||||
|
||||
/* Forward declaration */
|
||||
struct efx_nic;
|
||||
|
||||
|
|
|
@ -476,14 +476,18 @@ static struct sk_buff *efx_rx_mk_skb(struct efx_channel *channel,
|
|||
struct sk_buff *skb;
|
||||
|
||||
/* Allocate an SKB to store the headers */
|
||||
skb = netdev_alloc_skb(efx->net_dev, hdr_len + EFX_PAGE_SKB_ALIGN);
|
||||
skb = netdev_alloc_skb(efx->net_dev,
|
||||
efx->rx_ip_align + efx->rx_prefix_size +
|
||||
hdr_len);
|
||||
if (unlikely(skb == NULL))
|
||||
return NULL;
|
||||
|
||||
EFX_BUG_ON_PARANOID(rx_buf->len < hdr_len);
|
||||
|
||||
skb_reserve(skb, EFX_PAGE_SKB_ALIGN);
|
||||
memcpy(__skb_put(skb, hdr_len), eh, hdr_len);
|
||||
memcpy(skb->data + efx->rx_ip_align, eh - efx->rx_prefix_size,
|
||||
efx->rx_prefix_size + hdr_len);
|
||||
skb_reserve(skb, efx->rx_ip_align + efx->rx_prefix_size);
|
||||
__skb_put(skb, hdr_len);
|
||||
|
||||
/* Append the remaining page(s) onto the frag list */
|
||||
if (rx_buf->len > hdr_len) {
|
||||
|
|
Loading…
Reference in a new issue