Commit 12f2d033 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

eth: bnxt: fix missing ring index trim on error path 



Commit under Fixes converted tx_prod to be free running but missed
masking it on the Tx error path. This crashes on error conditions,
for example when DMA mapping fails.

Fixes: 6d1add95 ("bnxt_en: Modify TX ring indexing logic.")
Reviewed-by: default avatarMichael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20250414143210.458625-1-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 903d2b9f

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+2 −2
Original line number Diff line number Diff line
@@ -787,7 +787,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	dev_kfree_skb_any(skb);

tx_kick_pending:

	if (BNXT_TX_PTP_IS_SET(lflags)) {

		txr->tx_buf_ring[txr->tx_prod].is_ts_pkt = 0;

		txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].is_ts_pkt = 0;

		atomic64_inc(&bp->ptp_cfg->stats.ts_err);

		if (!(bp->fw_cap & BNXT_FW_CAP_TX_TS_CMP))

			/* set SKB to err so PTP worker will clean up */
@@ -795,7 +795,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	}

	if (txr->kick_pending)

		bnxt_txr_db_kick(bp, txr, txr->tx_prod);

	txr->tx_buf_ring[txr->tx_prod].skb = NULL;

	txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].skb = NULL;

	dev_core_stats_tx_dropped_inc(dev);

	return NETDEV_TX_OK;

}