From: Dave Hansen This patch fixes a race condition that would panic the kernel when replenishing a buffer pool. Signed-off-by: Andrew Morton --- 25-akpm/drivers/net/ibmveth.c | 5 +++-- 25-akpm/drivers/net/ibmveth.h | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff -puN drivers/net/ibmveth.c~ibmveth-race-fix drivers/net/ibmveth.c --- 25/drivers/net/ibmveth.c~ibmveth-race-fix 2004-08-15 13:02:38.527999712 -0700 +++ 25-akpm/drivers/net/ibmveth.c 2004-08-15 13:02:38.532998952 -0700 @@ -214,11 +214,12 @@ static void ibmveth_replenish_buffer_poo free_index = pool->consumer_index++ % pool->size; index = pool->free_map[free_index]; - ibmveth_assert(index != 0xffff); + ibmveth_assert(index != IBM_VETH_INVALID_MAP); ibmveth_assert(pool->skbuff[index] == NULL); dma_addr = vio_map_single(adapter->vdev, skb->data, pool->buff_size, DMA_FROM_DEVICE); + pool->free_map[free_index] = IBM_VETH_INVALID_MAP; pool->dma_addr[index] = dma_addr; pool->skbuff[index] = skb; @@ -233,6 +234,7 @@ static void ibmveth_replenish_buffer_poo lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address, desc.desc); if(lpar_rc != H_Success) { + pool->free_map[free_index] = IBM_VETH_INVALID_MAP; pool->skbuff[index] = NULL; pool->consumer_index--; vio_unmap_single(adapter->vdev, pool->dma_addr[index], pool->buff_size, DMA_FROM_DEVICE); @@ -240,7 +242,6 @@ static void ibmveth_replenish_buffer_poo adapter->replenish_add_buff_failure++; break; } else { - pool->free_map[free_index] = 0xffff; buffers_added++; adapter->replenish_add_buff_success++; } diff -puN drivers/net/ibmveth.h~ibmveth-race-fix drivers/net/ibmveth.h --- 25/drivers/net/ibmveth.h~ibmveth-race-fix 2004-08-15 13:02:38.528999560 -0700 +++ 25-akpm/drivers/net/ibmveth.h 2004-08-15 13:02:38.540997736 -0700 @@ -77,6 +77,8 @@ #define IbmVethPool1DftCnt 256 #define IbmVethPool2DftCnt 256 +#define IBM_VETH_INVALID_MAP ((u16)0xffff) + struct ibmveth_buff_pool { u32 size; u32 index; _