net: hns3: fix desc filling bug when skb is expanded or lineared

The linear and frag data part may be changed when the skb is expanded
or lineared in skb_cow_head() or skb_checksum_help(), which is called
by hns3_fill_skb_desc(), so the linear len return by skb_headlen()
before the calling of hns3_fill_skb_desc() is unreliable.

Move hns3_fill_skb_desc() before the calling of skb_headlen() to fix
this bug.

Fixes: 6e2406330b28 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 33c481d11116a7793c3e4e9374cfcd9fd8999ce7..3328500c0543739ff3ef0c6b785fcaa1b3ee74fb 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1093,16 +1093,8 @@ static int hns3_fill_desc(struct hns3_enet_ring *ring, void *priv,
        int k, sizeoflast;
        dma_addr_t dma;
 
-       if (type == DESC_TYPE_SKB) {
-               struct sk_buff *skb = (struct sk_buff *)priv;
-               int ret;
-
-               ret = hns3_fill_skb_desc(ring, skb, desc);
-               if (unlikely(ret < 0))
-                       return ret;
-
-               dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
-       } else if (type == DESC_TYPE_FRAGLIST_SKB) {
+       if (type == DESC_TYPE_FRAGLIST_SKB ||
+           type == DESC_TYPE_SKB) {
                struct sk_buff *skb = (struct sk_buff *)priv;
 
                dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
@@ -1439,6 +1431,10 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 
        next_to_use_head = ring->next_to_use;
 
+       ret = hns3_fill_skb_desc(ring, skb, &ring->desc[ring->next_to_use]);
+       if (unlikely(ret < 0))
+               goto fill_err;
+
        ret = hns3_fill_skb_to_desc(ring, skb, DESC_TYPE_SKB);
        if (unlikely(ret < 0))
                goto fill_err;