From 7264df388616d2fa21d4cb97336e7e2afe3759ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Wed, 17 Aug 2016 12:54:49 +0200 Subject: kernel: bgmac: backport 3 remaining small fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This makes bgmac in sync with upstream verison. Signed-off-by: Rafał Miłecki --- ...mac-Fix-infinite-loop-in-bgmac_dma_tx_add.patch | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 target/linux/generic/patches-4.4/076-0003-net-bgmac-Fix-infinite-loop-in-bgmac_dma_tx_add.patch (limited to 'target/linux/generic/patches-4.4/076-0003-net-bgmac-Fix-infinite-loop-in-bgmac_dma_tx_add.patch') diff --git a/target/linux/generic/patches-4.4/076-0003-net-bgmac-Fix-infinite-loop-in-bgmac_dma_tx_add.patch b/target/linux/generic/patches-4.4/076-0003-net-bgmac-Fix-infinite-loop-in-bgmac_dma_tx_add.patch new file mode 100644 index 0000000..3834e64 --- /dev/null +++ b/target/linux/generic/patches-4.4/076-0003-net-bgmac-Fix-infinite-loop-in-bgmac_dma_tx_add.patch @@ -0,0 +1,27 @@ +From e86663c475d384ab5f46cb5637e9b7ad08c5c505 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 15 Jul 2016 15:42:52 -0700 +Subject: [PATCH] net: bgmac: Fix infinite loop in bgmac_dma_tx_add() + +Nothing is decrementing the index "i" while we are cleaning up the +fragments we could not successful transmit. + +Fixes: 9cde94506eacf ("bgmac: implement scatter/gather support") +Reported-by: coverity (CID 1352048) +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +--- + drivers/net/ethernet/broadcom/bgmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bgmac.c ++++ b/drivers/net/ethernet/broadcom/bgmac.c +@@ -207,7 +207,7 @@ err_dma: + dma_unmap_single(dma_dev, slot->dma_addr, skb_headlen(skb), + DMA_TO_DEVICE); + +- while (i > 0) { ++ while (i-- > 0) { + int index = (ring->end + i) % BGMAC_TX_RING_SLOTS; + struct bgmac_slot_info *slot = &ring->slots[index]; + u32 ctl1 = le32_to_cpu(ring->cpu_base[index].ctl1); -- cgit v1.1