On the error recovery resource unwind path, it is possible for the
driver to attempt to unmap a fragment that hadn't been mapped. This
patch fixes the problem by correcting the "last" parameter supplied.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
txb = &tnapi->tx_buffers[entry];
}
txb = &tnapi->tx_buffers[entry];
}
- for (i = 0; i < last; i++) {
+ for (i = 0; i <= last; i++) {
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
entry = NEXT_TX(entry);
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
entry = NEXT_TX(entry);
if (tg3_tx_frag_set(tnapi, entry, budget, new_addr,
new_skb->len, base_flags,
mss, vlan)) {
if (tg3_tx_frag_set(tnapi, entry, budget, new_addr,
new_skb->len, base_flags,
mss, vlan)) {
- tg3_tx_skb_unmap(tnapi, save_entry, 0);
+ tg3_tx_skb_unmap(tnapi, save_entry, -1);
dev_kfree_skb(new_skb);
ret = -1;
}
dev_kfree_skb(new_skb);
ret = -1;
}
if (tg3_tx_frag_set(tnapi, &entry, &budget, mapping, len, base_flags |
((skb_shinfo(skb)->nr_frags == 0) ? TXD_FLAG_END : 0),
if (tg3_tx_frag_set(tnapi, &entry, &budget, mapping, len, base_flags |
((skb_shinfo(skb)->nr_frags == 0) ? TXD_FLAG_END : 0),
/* Now loop through additional data fragments, and queue them. */
/* Now loop through additional data fragments, and queue them. */
- if (skb_shinfo(skb)->nr_frags > 0) {
+ } else if (skb_shinfo(skb)->nr_frags > 0) {
u32 tmp_mss = mss;
if (!tg3_flag(tp, HW_TSO_1) &&
u32 tmp_mss = mss;
if (!tg3_flag(tp, HW_TSO_1) &&
return NETDEV_TX_OK;
dma_error:
return NETDEV_TX_OK;
dma_error:
- tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, i);
+ tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, --i);
tnapi->tx_buffers[tnapi->tx_prod].skb = NULL;
drop:
dev_kfree_skb(skb);
tnapi->tx_buffers[tnapi->tx_prod].skb = NULL;
drop:
dev_kfree_skb(skb);
- tg3_tx_skb_unmap(tnapi, i, skb_shinfo(skb)->nr_frags);
+ tg3_tx_skb_unmap(tnapi, i,
+ skb_shinfo(skb)->nr_frags - 1);
dev_kfree_skb_any(skb);
}
dev_kfree_skb_any(skb);
}
- tg3_tx_skb_unmap(tnapi, tnapi->tx_prod - 1, 0);
+ tg3_tx_skb_unmap(tnapi, tnapi->tx_prod - 1, -1);
dev_kfree_skb(skb);
if (tx_idx != tnapi->tx_prod)
dev_kfree_skb(skb);
if (tx_idx != tnapi->tx_prod)