提交 626b598a 编写于 作者: D Dan Carpenter 提交者: Jakub Kicinski

net: enetc: fix array underflow in error handling code

This loop will try to unmap enetc_unmap_tx_buff[-1] and crash.

Fixes: 9d2b68cc ("net: enetc: add support for XDP_REDIRECT")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NClaudiu Manoil <claudiu.manoil@nxp.com>
Reviewed-by: NVladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/YHBHfCY/yv3EnM9z@mwandaSigned-off-by: NJakub Kicinski <kuba@kernel.org>
上级 524e001b
...@@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring, ...@@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring,
dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE); dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE);
if (unlikely(dma_mapping_error(tx_ring->dev, dma))) { if (unlikely(dma_mapping_error(tx_ring->dev, dma))) {
/* Undo the DMA mapping for all fragments */ /* Undo the DMA mapping for all fragments */
while (n-- >= 0) while (--n >= 0)
enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]); enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]);
netdev_err(tx_ring->ndev, "DMA map error\n"); netdev_err(tx_ring->ndev, "DMA map error\n");
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册