Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc()

The error path in t7xx_dpmaif_rx_buf_alloc(), free and unmap the already
allocated and mapped skb in a loop, but the loop condition terminates when
the index reaches zero, which fails to free the first allocated skb at
index zero.

Check with i-- so that skb at index 0 is freed as well.

Cc: stable@vger.kernel.org
Fixes: d642b012df70 ("net: wwan: t7xx: Add data path interface")
Acked-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20241101025316.3234023-1-ruanjinjie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Jinjie Ruan and committed by
Jakub Kicinski
3b557be8 b2183187

+1 -1
+1 -1
drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
··· 226 226 return 0; 227 227 228 228 err_unmap_skbs: 229 - while (--i > 0) 229 + while (i--) 230 230 t7xx_unmap_bat_skb(dpmaif_ctrl->dev, bat_req->bat_skb, i); 231 231 232 232 return ret;