X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=target%2Flinux%2Fbrcm2708%2Fpatches-4.4%2F0471-enc28j60-Fix-race-condition-in-enc28j60-driver.patch;fp=target%2Flinux%2Fbrcm2708%2Fpatches-4.4%2F0471-enc28j60-Fix-race-condition-in-enc28j60-driver.patch;h=0000000000000000000000000000000000000000;hb=d9d090e52082635a24aeaefdc6bfe61ab97f38bb;hp=7ae5607fcdd315a6bb9e52d47f270b68316cfea8;hpb=ada91d8a245690b3bc8d2a62b391d2725aea5c8e;p=openwrt%2Fstaging%2Fyousong.git

diff --git a/target/linux/brcm2708/patches-4.4/0471-enc28j60-Fix-race-condition-in-enc28j60-driver.patch b/target/linux/brcm2708/patches-4.4/0471-enc28j60-Fix-race-condition-in-enc28j60-driver.patch
deleted file mode 100644
index 7ae5607fcd..0000000000
--- a/target/linux/brcm2708/patches-4.4/0471-enc28j60-Fix-race-condition-in-enc28j60-driver.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 5ba5e453917fbd38b64b99af7b5a23b7ba2eb327 Mon Sep 17 00:00:00 2001
-From: Sergio Valverde <sergio.valverde@hpe.com>
-Date: Fri, 1 Jul 2016 11:44:30 -0600
-Subject: [PATCH] enc28j60: Fix race condition in enc28j60 driver
-
-(Upstream commit 373819ec391de0d11f63b10b2fb69ef2854236ca)
-
-The interrupt worker code for the enc28j60 relies only on the TXIF flag to
-determinate if the packet transmission was completed. However the datasheet
-specifies in section 12.1.3 that TXERIF will clear the TXRTS after a
-transmit abort. Also in section 12.1.4 that TXIF will be set
-when TXRTS transitions from '1' to '0'. Therefore the TXIF flag is enabled
-during transmission errors.
-
-This causes a race condition, since the worker code will invoke
-enc28j60_tx_clear() -> netif_wake_queue(), potentially invoking the
-ndo_start_xmit function to send a new packet. The enc28j60_send_packet function
-uses a workqueue that invokes enc28j60_hw_tx(). In between this function is
-called, the worker from the interrupt handler will enter the path for error
-handler because of the TXERIF flag, causing to invoke enc28j60_tx_clear() again
-and releasing the packet scheduled for transmission, causing a kernel crash with
-due a NULL pointer.
-
-These crashes due a NULL pointer were observed under stress conditions of the
-device. A BUG_ON() sequence was used to validate the issue was fixed, and has
-been running without problems for 2 years now.
-
-Signed-off-by: Diego Dompe <dompe@hpe.com>
-Acked-by: Sergio Valverde <sergio.valverde@hpe.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/ethernet/microchip/enc28j60.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
---- a/drivers/net/ethernet/microchip/enc28j60.c
-+++ b/drivers/net/ethernet/microchip/enc28j60.c
-@@ -1147,7 +1147,8 @@ static void enc28j60_irq_work_handler(st
- 			enc28j60_phy_read(priv, PHIR);
- 		}
- 		/* TX complete handler */
--		if ((intflags & EIR_TXIF) != 0) {
-+		if (((intflags & EIR_TXIF) != 0) &&
-+		    ((intflags & EIR_TXERIF) == 0)) {
- 			bool err = false;
- 			loop++;
- 			if (netif_msg_intr(priv))
-@@ -1199,7 +1200,7 @@ static void enc28j60_irq_work_handler(st
- 					enc28j60_tx_clear(ndev, true);
- 			} else
- 				enc28j60_tx_clear(ndev, true);
--			locked_reg_bfclr(priv, EIR, EIR_TXERIF);
-+			locked_reg_bfclr(priv, EIR, EIR_TXERIF | EIR_TXIF);
- 		}
- 		/* RX Error handler */
- 		if ((intflags & EIR_RXERIF) != 0) {
-@@ -1234,6 +1235,8 @@ static void enc28j60_irq_work_handler(st
-  */
- static void enc28j60_hw_tx(struct enc28j60_net *priv)
- {
-+	BUG_ON(!priv->tx_skb);
-+
- 	if (netif_msg_tx_queued(priv))
- 		printk(KERN_DEBUG DRV_NAME
- 			": Tx Packet Len:%d\n", priv->tx_skb->len);