[netdrvr r8169] fix TX descriptor overflow

Please apply attached patch.

Without patch, bogus descriptors are parsed as soon as
tp->cur_tx%NUM_TX_DESC + (tp->cur_tx - tp->dirty_tx) > NUM_TX_DESC
(assume for instance tp->dirty_tx = NUM_TX_DESC/2,
tp->cur_tx = NUM_TX_DESC - 1 and watch entry go beyond NUM_TX_DESC).

Missing stats update is fixed by the patch btw.

drivers/net/r8169.c

@@ -871,7 +871,6 @@ rtl8169_tx_interrupt(struct net_device *dev, struct rtl8169_private *tp,
 		     void *ioaddr)
 {
 	unsigned long dirty_tx, tx_left = 0;
-	int entry = tp->cur_tx % NUM_TX_DESC;
 
 	assert(dev != NULL);
 	assert(tp != NULL);
@@ -881,14 +880,18 @@ rtl8169_tx_interrupt(struct net_device *dev, struct rtl8169_private *tp,
 	tx_left = tp->cur_tx - dirty_tx;
 
 	while (tx_left > 0) {
+		int entry = dirty_tx % NUM_TX_DESC;
+
 		if ((tp->TxDescArray[entry].status & OWNbit) == 0) {
-			dev_kfree_skb_irq(tp->
-					  Tx_skbuff[dirty_tx % NUM_TX_DESC]);
-			tp->Tx_skbuff[dirty_tx % NUM_TX_DESC] = NULL;
+			struct sk_buff *skb = tp->Tx_skbuff[entry];
+
+			tp->stats.tx_bytes += skb->len >= ETH_ZLEN ?
+					      skb->len : ETH_ZLEN;
 			tp->stats.tx_packets++;
+			dev_kfree_skb_irq(skb);
+			tp->Tx_skbuff[entry] = NULL;
 			dirty_tx++;
 			tx_left--;
-			entry++;
 		}
 	}