Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

eth: bnxt: fix missing ring index trim on error path

Commit under Fixes converted tx_prod to be free running but missed
masking it on the Tx error path. This crashes on error conditions,
for example when DMA mapping fails.

Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.")
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20250414143210.458625-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

+2 -2
+2 -2
drivers/net/ethernet/broadcom/bnxt/bnxt.c
··· 787 787 dev_kfree_skb_any(skb); 788 788 tx_kick_pending: 789 789 if (BNXT_TX_PTP_IS_SET(lflags)) { 790 - txr->tx_buf_ring[txr->tx_prod].is_ts_pkt = 0; 790 + txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].is_ts_pkt = 0; 791 791 atomic64_inc(&bp->ptp_cfg->stats.ts_err); 792 792 if (!(bp->fw_cap & BNXT_FW_CAP_TX_TS_CMP)) 793 793 /* set SKB to err so PTP worker will clean up */ ··· 795 795 } 796 796 if (txr->kick_pending) 797 797 bnxt_txr_db_kick(bp, txr, txr->tx_prod); 798 - txr->tx_buf_ring[txr->tx_prod].skb = NULL; 798 + txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].skb = NULL; 799 799 dev_core_stats_tx_dropped_inc(dev); 800 800 return NETDEV_TX_OK; 801 801 }