diff options
author | Florian Fainelli <f.fainelli@gmail.com> | 2016-07-15 18:42:52 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2016-07-15 19:03:47 -0400 |
commit | e86663c475d384ab5f46cb5637e9b7ad08c5c505 (patch) | |
tree | 73991452764e36e6e42e149141ec1680bff58f39 | |
parent | f57ec1889f5e830e93723d1262fd9c73703d531d (diff) |
net: bgmac: Fix infinite loop in bgmac_dma_tx_add()
Nothing is decrementing the index "i" while we are cleaning up the
fragments we could not successful transmit.
Fixes: 9cde94506eacf ("bgmac: implement scatter/gather support")
Reported-by: coverity (CID 1352048)
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | drivers/net/ethernet/broadcom/bgmac.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c index a6333d38ecc0..25bbae5928d4 100644 --- a/drivers/net/ethernet/broadcom/bgmac.c +++ b/drivers/net/ethernet/broadcom/bgmac.c | |||
@@ -231,7 +231,7 @@ err_dma: | |||
231 | dma_unmap_single(dma_dev, slot->dma_addr, skb_headlen(skb), | 231 | dma_unmap_single(dma_dev, slot->dma_addr, skb_headlen(skb), |
232 | DMA_TO_DEVICE); | 232 | DMA_TO_DEVICE); |
233 | 233 | ||
234 | while (i > 0) { | 234 | while (i-- > 0) { |
235 | int index = (ring->end + i) % BGMAC_TX_RING_SLOTS; | 235 | int index = (ring->end + i) % BGMAC_TX_RING_SLOTS; |
236 | struct bgmac_slot_info *slot = &ring->slots[index]; | 236 | struct bgmac_slot_info *slot = &ring->slots[index]; |
237 | u32 ctl1 = le32_to_cpu(ring->cpu_base[index].ctl1); | 237 | u32 ctl1 = le32_to_cpu(ring->cpu_base[index].ctl1); |