RE: [PATCH net 1/8] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
From: Wei Fang
Date: Mon Feb 17 2025 - 21:11:48 EST
> > Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet
> drivers")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Wei Fang <wei.fang@xxxxxxx>
> > ---
> > drivers/net/ethernet/freescale/enetc/enetc.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c
> b/drivers/net/ethernet/freescale/enetc/enetc.c
> > index 6a6fc819dfde..f7bc2fc33a76 100644
> > --- a/drivers/net/ethernet/freescale/enetc/enetc.c
> > +++ b/drivers/net/ethernet/freescale/enetc/enetc.c
> > @@ -372,13 +372,13 @@ static int enetc_map_tx_buffs(struct enetc_bdr
> *tx_ring, struct sk_buff *skb)
> > dma_err:
> > dev_err(tx_ring->dev, "DMA map error");
> >
> > - do {
> > + while (count--) {
> > tx_swbd = &tx_ring->tx_swbd[i];
> > enetc_free_tx_frame(tx_ring, tx_swbd);
> > if (i == 0)
> > i = tx_ring->bd_count;
> > i--;
> > - } while (count--);
> > + };
>
> In enetc_lso_hw_offload() this is fixed by --count instead of changing
> to while and count--, maybe follow this scheme, or event better call
> helper function to fix in one place.
The situation is slightly different in enetc_map_tx_buffs(), the count
may be 0 when the error occurs. But in enetc_lso_hw_offload(), the
count will not be 0 when the error occurs.
>
> The same problem is probably in enetc_map_tx_tso_buffs().
>
I think there is no such problem in enetc_map_tx_tso_buffs(),
because the index 'i' has been increased before the error occurs,
but the count is not increased, so the actual 'count' is count + 1.