From: Chad Dupuis <cdupuis@redhat.com>
Date: Tue, 3 Aug 2010 13:52:27 -0400
Subject: [net] netxen: fix rcv buffer leak
Message-id: <20100803134943.2239.46850.sendpatchset@localhost.localdomain>
Patchwork-id: 27344
O-Subject: [RHEL 5.6 PATCH 42/44] netxen: fix rcv buffer leak
Bugzilla: 562937
RH-Acked-by: David S. Miller <davem@redhat.com>
RH-Acked-by: Neil Horman <nhorman@redhat.com>

Bugzilla
========

562937

Upstream Status
===============

net-2.6 commit id 2227bae22becb88b75ede022c7bb991aabfb50bb

Description
===========

>From d85cc2e2724b2f90580053f0c29e16608b0707c3 Mon Sep 17 00:00:00 2001
From: Amit Kumar Salecha <amit.salecha@qlogic.com>
Date: Sun, 13 Jun 2010 23:39:04 +0000
Subject: [PATCH] netxen: fix rcv buffer leak

Rcv producer should be read in spin-lock.

Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 73b321c..e079f27 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -1805,9 +1805,10 @@ netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
 	netxen_ctx_msg msg = 0;
 	struct list_head *head;
 
+	spin_lock(&rds_ring->lock);
+
 	producer = rds_ring->producer;
 
-	spin_lock(&rds_ring->lock);
 	head = &rds_ring->free_list;
 	while (!list_empty(head)) {
 
@@ -1829,7 +1830,6 @@ netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
 
 		producer = get_next_index(producer, rds_ring->num_desc);
 	}
-	spin_unlock(&rds_ring->lock);
 
 	if (count) {
 		rds_ring->producer = producer;
@@ -1853,6 +1853,8 @@ netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
 					NETXEN_RCV_PRODUCER_OFFSET), msg);
 		}
 	}
+
+	spin_unlock(&rds_ring->lock);
 }
 
 static void
@@ -1864,10 +1866,11 @@ netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter,
 	int producer, count = 0;
 	struct list_head *head;
 
-	producer = rds_ring->producer;
 	if (!spin_trylock(&rds_ring->lock))
 		return;
 
+	producer = rds_ring->producer;
+
 	head = &rds_ring->free_list;
 	while (!list_empty(head)) {