diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2021-12-30 23:12:12 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-12-30 23:12:12 +0300 |
| commit | aec53e60e0e665b359328b946654bc3ef77aed57 (patch) | |
| tree | 55c6cc087d96f5ca9ec4bdd81134fd2471c02700 /drivers/net/ethernet/aquantia | |
| parent | 49dc9013e34b205bae9d7a5f365a3da33c508c9d (diff) | |
| parent | 74c78b4291b4466b44a57b3b7c3b98ad02628686 (diff) | |
| download | linux-aec53e60e0e665b359328b946654bc3ef77aed57.tar.xz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
commit 077cdda764c7 ("net/mlx5e: TC, Fix memory leak with rules with internal port")
commit 31108d142f36 ("net/mlx5: Fix some error handling paths in 'mlx5e_tc_add_fdb_flow()'")
commit 4390c6edc0fb ("net/mlx5: Fix some error handling paths in 'mlx5e_tc_add_fdb_flow()'")
https://lore.kernel.org/all/20211229065352.30178-1-saeed@kernel.org/
net/smc/smc_wr.c
commit 49dc9013e34b ("net/smc: Use the bitmap API when applicable")
commit 349d43127dac ("net/smc: fix kernel panic caused by race of smc_sock")
bitmap_zero()/memset() is removed by the fix
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/aquantia')
| -rw-r--r-- | drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c index 81b3756417ec..77e76c9efd32 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c @@ -366,6 +366,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, if (!buff->is_eop) { buff_ = buff; do { + if (buff_->next >= self->size) { + err = -EIO; + goto err_exit; + } next_ = buff_->next, buff_ = &self->buff_ring[next_]; is_rsc_completed = @@ -389,6 +393,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, (buff->is_lro && buff->is_cso_err)) { buff_ = buff; do { + if (buff_->next >= self->size) { + err = -EIO; + goto err_exit; + } next_ = buff_->next, buff_ = &self->buff_ring[next_]; |