Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf377d88 authored by Florian Fainelli's avatar Florian Fainelli Committed by David S. Miller
Browse files

net: bcmgenet: fix off-by-one in incrementing read pointer 



Commit b629be5c ("net: bcmgenet: check
harder for out of memory conditions") moved the increment of the local
read pointer *before* reading from the hardware descriptor using
dmadesc_get_length_status(), which creates an off-by-one situation.

Fix this by moving again the read_ptr increment after we have read the
hardware descriptor to get both the control block and the read pointer
back in sync.

Fixes: b629be5c ("net: bcmgenet: check harder for out of memory conditions")
Signed-off-by: default avatarJaedon Shin <jaedon.shin@gmail.com>
Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Acked-by: default avatarPetri Gynther <pgynther@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 35b7a191

drivers/net/ethernet/broadcom/genet/bcmgenet.c

+4 −5
Original line number Diff line number Diff line
@@ -1285,11 +1285,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_priv *priv, 
		cb = &priv->rx_cbs[priv->rx_read_ptr];

		skb = cb->skb;



		rxpktprocessed++;



		priv->rx_read_ptr++;

		priv->rx_read_ptr &= (priv->num_rx_bds - 1);



		/* We do not have a backing SKB, so we do not have a

		 * corresponding DMA mapping for this incoming packet since

		 * bcmgenet_rx_refill always either has both skb and mapping or
@@ -1404,6 +1399,10 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_priv *priv, 
		err = bcmgenet_rx_refill(priv, cb);

		if (err)

			netif_err(priv, rx_err, dev, "Rx refill failed\n");



		rxpktprocessed++;

		priv->rx_read_ptr++;

		priv->rx_read_ptr &= (priv->num_rx_bds - 1);

	}



	return rxpktprocessed;