tp->dirty_tx and tp->cur_tx may be changed by a racing rtl_tx() or
rtl8169_start_xmit(). Use READ_ONCE() to annotate the races and ensure
that the compiler doesn't use cached values.

Signed-off-by: Heiner Kallweit <hkallwe...@gmail.com>
---
 drivers/net/ethernet/realtek/r8169_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c 
b/drivers/net/ethernet/realtek/r8169_main.c
index aa6f8b16d..641c94a46 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4144,7 +4144,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private 
*tp,
 static bool rtl_tx_slots_avail(struct rtl8169_private *tp,
                               unsigned int nr_frags)
 {
-       unsigned int slots_avail = tp->dirty_tx + NUM_TX_DESC - tp->cur_tx;
+       unsigned int slots_avail = READ_ONCE(tp->dirty_tx) + NUM_TX_DESC
+                                       - READ_ONCE(tp->cur_tx);
 
        /* A skbuff with nr_frags needs nr_frags+1 entries in the tx queue */
        return slots_avail > nr_frags;
-- 
2.29.2

Reply via email to