]> www.infradead.org Git - users/jedix/linux-maple.git/commit
bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.
authorMichael Chan <mchan@broadcom.com>
Thu, 28 Jan 2016 08:11:22 +0000 (03:11 -0500)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 7 Jul 2016 00:36:50 +0000 (17:36 -0700)
commit25d82696ffa4dfa89daa6621d6ea57bc8a14456f
treea66a57a24b870c5020f96922a940e119a310e282
parentdf549c6a4ff823662255cfce02413ebd55327eae
bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.

Orabug: 23221795

The ring index j is not wrapped properly at the end of the ring, causing
it to reference pointers past the end of the ring.  For proper loop
termination and to access the ring properly, we need to increment j and
mask it before referencing the ring entry.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit d612a579771385e08f7b665063b36bfa52c03ea3)
Signed-off-by: Brian Maly <brian.maly@oracle.com>
drivers/net/ethernet/broadcom/bnxt/bnxt.c