Re: [PATCH net 1/8] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()

[Michal Swiatkowski <michal.swiatkowski@linux.intel.com>]

On Tue, Feb 18, 2025 at 02:11:12AM +0000, Wei Fang wrote:
> > > Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet
> > drivers")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Wei Fang <wei.fang@nxp.com>
> > > ---
> > >  drivers/net/ethernet/freescale/enetc/enetc.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c
> > b/drivers/net/ethernet/freescale/enetc/enetc.c
> > > index 6a6fc819dfde..f7bc2fc33a76 100644
> > > --- a/drivers/net/ethernet/freescale/enetc/enetc.c
> > > +++ b/drivers/net/ethernet/freescale/enetc/enetc.c
> > > @@ -372,13 +372,13 @@ static int enetc_map_tx_buffs(struct enetc_bdr
> > *tx_ring, struct sk_buff *skb)
> > >  dma_err:
> > >  	dev_err(tx_ring->dev, "DMA map error");
> > >
> > > -	do {
> > > +	while (count--) {
> > >  		tx_swbd = &tx_ring->tx_swbd[i];
> > >  		enetc_free_tx_frame(tx_ring, tx_swbd);
> > >  		if (i == 0)
> > >  			i = tx_ring->bd_count;
> > >  		i--;
> > > -	} while (count--);
> > > +	};
> > 
> > In enetc_lso_hw_offload() this is fixed by --count instead of changing
> > to while and count--, maybe follow this scheme, or event better call
> > helper function to fix in one place.
> 
> The situation is slightly different in enetc_map_tx_buffs(), the count
> may be 0 when the error occurs. But in enetc_lso_hw_offload(), the
> count will not be 0 when the error occurs.

Right, didn't see that, sorry.

> 
> > 
> > The same problem is probably in enetc_map_tx_tso_buffs().
> > 
> 
> I think there is no such problem in enetc_map_tx_tso_buffs(),
> because the index 'i' has been increased before the error occurs,
> but the count is not increased, so the actual 'count' is count + 1.
>

But you can reach the error code jumping to label "err_chained_bd" where
both i and count is increased. Isn't it a problem?

BTW, not increasing i and count in one place looks like unnecessary
complication ;) .

Thanks,
Michal