From 25d82696ffa4dfa89daa6621d6ea57bc8a14456f Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Thu, 28 Jan 2016 03:11:22 -0500 Subject: [PATCH] bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout. Orabug: 23221795 The ring index j is not wrapped properly at the end of the ring, causing it to reference pointers past the end of the ring. For proper loop termination and to access the ring properly, we need to increment j and mask it before referencing the ring entry. Signed-off-by: Michael Chan Signed-off-by: David S. Miller (cherry picked from commit d612a579771385e08f7b665063b36bfa52c03ea3) Signed-off-by: Brian Maly --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 4a049ac1cd2a..43b2e1b8f005 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -1493,10 +1493,11 @@ static void bnxt_free_tx_skbs(struct bnxt *bp) last = tx_buf->nr_frags; j += 2; - for (k = 0; k < last; k++, j = NEXT_TX(j)) { + for (k = 0; k < last; k++, j++) { + int ring_idx = j & bp->tx_ring_mask; skb_frag_t *frag = &skb_shinfo(skb)->frags[k]; - tx_buf = &txr->tx_buf_ring[j]; + tx_buf = &txr->tx_buf_ring[ring_idx]; dma_unmap_page( &pdev->dev, dma_unmap_addr(tx_buf, mapping), -- 2.50.1