diff options
| author | Michael Chan <mchan@broadcom.com> | 2016-01-28 03:11:22 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-01-29 17:28:39 -0800 |
| commit | d612a579771385e08f7b665063b36bfa52c03ea3 (patch) | |
| tree | 448f38fc7edb9b10372b2fd0bf1abacdb3bfd80f | |
| parent | 8a4d4c8dde7a4119bce3fd8287dca193ff6356da (diff) | |
bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.
The ring index j is not wrapped properly at the end of the ring, causing
it to reference pointers past the end of the ring. For proper loop
termination and to access the ring properly, we need to increment j and
mask it before referencing the ring entry.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index ebc541340ea1..5dc89e527e7d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -1490,10 +1490,11 @@ static void bnxt_free_tx_skbs(struct bnxt *bp) last = tx_buf->nr_frags; j += 2; - for (k = 0; k < last; k++, j = NEXT_TX(j)) { + for (k = 0; k < last; k++, j++) { + int ring_idx = j & bp->tx_ring_mask; skb_frag_t *frag = &skb_shinfo(skb)->frags[k]; - tx_buf = &txr->tx_buf_ring[j]; + tx_buf = &txr->tx_buf_ring[ring_idx]; dma_unmap_page( &pdev->dev, dma_unmap_addr(tx_buf, mapping), |