Commit 57f3f53d authored by Justin Chen's avatar Justin Chen Committed by Jakub Kicinski
Browse files

net: bcmgenet: fix off-by-one in bcmgenet_put_txcb 



The write_ptr points to the next open tx_cb. We want to return the
tx_cb that gets rewinded, so we must rewind the pointer first then
return the tx_cb that it points to. That way the txcb can be correctly
cleaned up.

Fixes: 876dbadd ("net: bcmgenet: Fix unmapping of fragments in bcmgenet_xmit()")
Signed-off-by: default avatarJustin Chen <justin.chen@broadcom.com>
Reviewed-by: default avatarNicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20260406175756.134567-2-justin.chen@broadcom.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent b02e3c4c

drivers/net/ethernet/broadcom/genet/bcmgenet.c

+3 −3
Original line number Diff line number Diff line
@@ -1819,15 +1819,15 @@ static struct enet_cb *bcmgenet_put_txcb(struct bcmgenet_priv *priv, 
{

	struct enet_cb *tx_cb_ptr;



	tx_cb_ptr = ring->cbs;

	tx_cb_ptr += ring->write_ptr - ring->cb_ptr;



	/* Rewinding local write pointer */

	if (ring->write_ptr == ring->cb_ptr)

		ring->write_ptr = ring->end_ptr;

	else

		ring->write_ptr--;



	tx_cb_ptr = ring->cbs;

	tx_cb_ptr += ring->write_ptr - ring->cb_ptr;



	return tx_cb_ptr;

}