net-next: Fix an overflow bug in vmxnet3 Tx descriptor

Fix an overflow bug in vmxnet3 Tx descriptor

This patch fixes a bug where a 16K buffer on a Tx descriptor was overflowing
into the 'gen' bit in the descriptor thereby corrupting the descriptor and
stalling the transmit ring.

Signed-off-by: Bhavesh Davda <bhavesh@vmware.com>
Signed-off-by: Shreyas Bhatewara <sbhatewara@vmware.com>
Signed-off-by: Matthew Delco <delcoM@vmware.com>
Signed-off-by: Ronghua Zhang <ronghua@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 9d64186050f3373505f275e7bde9f67eb3429f37..abe0ff53daf353c1be44876b19cf37f4cefe4403 100644 (file)
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -664,8 +664,13 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
        while (len) {
                u32 buf_size;
 
-               buf_size = len > VMXNET3_MAX_TX_BUF_SIZE ?
-                          VMXNET3_MAX_TX_BUF_SIZE : len;
+               if (len < VMXNET3_MAX_TX_BUF_SIZE) {
+                       buf_size = len;
+                       dw2 |= len;
+               } else {
+                       buf_size = VMXNET3_MAX_TX_BUF_SIZE;
+                       /* spec says that for TxDesc.len, 0 == 2^14 */
+               }
 
                tbi = tq->buf_info + tq->tx_ring.next2fill;
                tbi->map_type = VMXNET3_MAP_SINGLE;
@@ -673,13 +678,13 @@ vmxnet3_map_pkt(struct sk_buff *skb, struct vmxnet3_tx_ctx *ctx,
                                skb->data + buf_offset, buf_size,
                                PCI_DMA_TODEVICE);
 
-               tbi->len = buf_size; /* this automatically convert 2^14 to 0 */
+               tbi->len = buf_size;
 
                gdesc = tq->tx_ring.base + tq->tx_ring.next2fill;
                BUG_ON(gdesc->txd.gen == tq->tx_ring.gen);
 
                gdesc->txd.addr = cpu_to_le64(tbi->dma_addr);
-               gdesc->dword[2] = cpu_to_le32(dw2 | buf_size);
+               gdesc->dword[2] = cpu_to_le32(dw2);
                gdesc->dword[3] = 0;
 
                dev_dbg(&adapter->netdev->dev,

diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 762a6a7763fed22f0c88074f596855a3b70ce033..2121c735cabd6ab3fddf335d302f7803cef87a76 100644 (file)
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -68,10 +68,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.0.13.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.0.14.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01000B00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01000E00
 
 
 /*