On Fri, Apr 09, 2021 at 03:24:28PM +0300, Dan Carpenter wrote:
> This loop will try to unmap enetc_unmap_tx_buff[-1] and crash.
>
> Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
> drivers/net/ethernet/freescale/enetc/enetc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
> index 57049ae97201..d86395775ed0 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc.c
> @@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring,
> dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE);
> if (unlikely(dma_mapping_error(tx_ring->dev, dma))) {
> /* Undo the DMA mapping for all fragments */
> - while (n-- >= 0)
> + while (--n >= 0)
> enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]);
>
> netdev_err(tx_ring->ndev, "DMA map error\n");
> --
> 2.30.2
>
I have no idea what went wrong. I distinctly remember "testing" this by
writing up a small program:
#include <stdio.h>
int main(void)
{
int n = 5;
while (n-- >= 0)
printf("%d\n", n);
return 0;
}
I find myself doing that most of the time when there is a need for an
unrolling loop. I do see that this goes down to -1, I wonder how I
missed it.
Reviewed-by: Vladimir Oltean <vladimir.oltean@xxxxxxx>
