From 33dae59a57f132d861406ca6acea509903488e4f Mon Sep 17 00:00:00 2001 From: Aurelien Jarno Date: Sat, 26 Jan 2019 01:11:10 +0100 Subject: [PATCH] drivers: eth: gmac: fix race condition in packet reference counting The SAM E70 GMAC ethernet driver reference a packet with net_pkt_ref() when queueing a packet, and unreference it with net_pkt_unref() in the ISR when it has been fully sent. The call to net_pkt_ref() is done just after re-enabling the interruptions, so there is however a small race condition that might cause the packet to be unreference before being referenced. This is only theoretical and has not been seen in practice. Fix that by moving the call to net_pkt_ref() just before re-enabling the interruptions. Signed-off-by: Aurelien Jarno --- drivers/ethernet/eth_sam_gmac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ethernet/eth_sam_gmac.c b/drivers/ethernet/eth_sam_gmac.c index ab66c450a8..618f66b5ee 100644 --- a/drivers/ethernet/eth_sam_gmac.c +++ b/drivers/ethernet/eth_sam_gmac.c @@ -1396,11 +1396,11 @@ static int eth_tx(struct device *dev, struct net_pkt *pkt) /* Account for a sent frame */ ring_buf_put(&queue->tx_frames, POINTER_TO_UINT(pkt)); - irq_unlock(key); - /* pkt is internally queued, so it requires to hold a reference */ net_pkt_ref(pkt); + irq_unlock(key); + /* Guarantee that the first fragment got its bit removed before starting * sending packets to avoid packets getting stuck. */