Re: [PATCH net v2 1/4] net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

[Nicolai Buchwitz <nb@tipi-net.de>]

On 1.4.2026 02:38, Justin Chen wrote:
> The write_ptr points to the next open tx_cb. We want to return the
> tx_cb that gets rewinded, so we must rewind the pointer first then
> return the tx_cb that it points to. That way the txcb can be correctly
> cleaned up.
> 
> Fixes: 876dbadd53a7 ("net: bcmgenet: Fix unmapping of fragments in 
> bcmgenet_xmit()")
> Signed-off-by: Justin Chen <justin.chen@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c 
> b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> index 482a31e7b72b..0f6e4baba25b 100644
> --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> @@ -1819,15 +1819,15 @@ static struct enet_cb *bcmgenet_put_txcb(struct 
> bcmgenet_priv *priv,
>  {
>  	struct enet_cb *tx_cb_ptr;
> 
> -	tx_cb_ptr = ring->cbs;
> -	tx_cb_ptr += ring->write_ptr - ring->cb_ptr;
> -
>  	/* Rewinding local write pointer */
>  	if (ring->write_ptr == ring->cb_ptr)
>  		ring->write_ptr = ring->end_ptr;
>  	else
>  		ring->write_ptr--;
> 
> +	tx_cb_ptr = ring->cbs;
> +	tx_cb_ptr += ring->write_ptr - ring->cb_ptr;
> +
>  	return tx_cb_ptr;
>  }

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks

Nicolai