Commit d612a579 authored by Michael Chan's avatar Michael Chan Committed by David S. Miller

bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.

The ring index j is not wrapped properly at the end of the ring, causing
it to reference pointers past the end of the ring.  For proper loop
termination and to access the ring properly, we need to increment j and
mask it before referencing the ring entry.
Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8a4d4c8d
...@@ -1490,10 +1490,11 @@ static void bnxt_free_tx_skbs(struct bnxt *bp) ...@@ -1490,10 +1490,11 @@ static void bnxt_free_tx_skbs(struct bnxt *bp)
last = tx_buf->nr_frags; last = tx_buf->nr_frags;
j += 2; j += 2;
for (k = 0; k < last; k++, j = NEXT_TX(j)) { for (k = 0; k < last; k++, j++) {
int ring_idx = j & bp->tx_ring_mask;
skb_frag_t *frag = &skb_shinfo(skb)->frags[k]; skb_frag_t *frag = &skb_shinfo(skb)->frags[k];
tx_buf = &txr->tx_buf_ring[j]; tx_buf = &txr->tx_buf_ring[ring_idx];
dma_unmap_page( dma_unmap_page(
&pdev->dev, &pdev->dev,
dma_unmap_addr(tx_buf, mapping), dma_unmap_addr(tx_buf, mapping),
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment