system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-08 12:22:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.

Browse source 
The ring index j is not wrapped properly at the end of the ring, causing
it to reference pointers past the end of the ring.  For proper loop
termination and to access the ring properly, we need to increment j and
mask it before referencing the ring entry.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Michael Chan 2016-01-28 03:11:22 -05:00 committed by David S. Miller
parent 8a4d4c8dde
commit d612a57977
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/net/ethernet/broadcom/bnxt/bnxt.c
View file

@ -1490,10 +1490,11 @@ static void bnxt_free_tx_skbs(struct bnxt *bp)
last = tx_buf->nr_frags;
j += 2;
for (k = 0; k < last; k++, j = NEXT_TX(j)) {
for (k = 0; k < last; k++, j++) {
int ring_idx = j & bp->tx_ring_mask;
skb_frag_t *frag = &skb_shinfo(skb)->frags[k];
tx_buf = &txr->tx_buf_ring[j];
tx_buf = &txr->tx_buf_ring[ring_idx];
dma_unmap_page(
&pdev->dev,
dma_unmap_addr(tx_buf, mapping),