@@ -3967,12 +3967,10 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
dma_error:
dev_err(&pdev->dev, "TX DMA map failed\n");
buffer_info->dma = 0;
- if (count)
- count--;
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
buffer_info = &tx_ring->buffer_info[i];
e1000_put_txbuf(adapter, buffer_info);;
@@ -2164,13 +2164,11 @@ dma_error:
buffer_info->length = 0;
buffer_info->next_to_watch = 0;
buffer_info->mapped_as_page = false;
- if (count)
- count--;
/* clear timestamp and dma mappings for remaining portion of packet */
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
buffer_info = &tx_ring->buffer_info[i];
igbvf_put_txbuf(adapter, buffer_info);
@@ -1363,12 +1363,10 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
dma_error:
dev_err(&pdev->dev, "TX DMA map failed\n");
buffer_info->dma = 0;
- if (count)
- count--;
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
buffer_info = &tx_ring->buffer_info[i];
ixgb_unmap_and_free_tx_resource(adapter, buffer_info);
@@ -5167,13 +5167,11 @@ dma_error:
tx_buffer_info->dma = 0;
tx_buffer_info->time_stamp = 0;
tx_buffer_info->next_to_watch = 0;
- if (count)
- count--;
/* clear timestamp and dma mappings for remaining portion of packet */
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
tx_buffer_info = &tx_ring->tx_buffer_info[i];
ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
These functions have off by one errors in their dma mapping error cleanup paths. We decrement count and never clean the first successfully mapped descriptor. Reported-by: "Anton Blanchard" <anton@samba.org> Reported-by: "Juha Leppanen" <juha_motorsportcom@luukku.com> Signed-off-by: Roel Kluin <roel.kluin@gmail.com> --- drivers/net/e1000e/netdev.c | 4 +--- drivers/net/igbvf/netdev.c | 4 +--- drivers/net/ixgb/ixgb_main.c | 4 +--- drivers/net/ixgbe/ixgbe_main.c | 4 +--- 4 files changed, 4 insertions(+), 12 deletions(-) My previous fix inadvertently introduced this change. The e1000_tx_map() function in drivers/net/e1000/e1000_main.c is already fixed by the patch sent by Anton Blanchard that can be found here: http://www.mail-archive.com/e1000-devel@lists.sourceforge.net/msg02313.html -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html