]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net: stmmac: descs: fix buffer 1 off-by-one error
authorRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
Thu, 8 Jan 2026 17:36:24 +0000 (17:36 +0000)
committerJakub Kicinski <kuba@kernel.org>
Tue, 13 Jan 2026 02:02:11 +0000 (18:02 -0800)
commitec3fde9eead03bc944ad14d32de11f17c2291306
tree5d3cc09758c327a5aefc60f5d79ec5a3b99d02e8
parente91a7e45bf0b013dd63bc3311c25e95b498d27f0
net: stmmac: descs: fix buffer 1 off-by-one error

norm_set_tx_desc_len_on_ring() incorrectly tests the buffer length,
leading to a length of 2048 being squeezed into a bitfield covering
bits 10:0 - which results in the buffer 1 size being zero.

If this field is zero, buffer 1 is ignored, and thus is equivalent to
transmitting a zero length buffer.

The path to norm_set_tx_desc_len_on_ring() is only possible when the
hardware does not support enhanced descriptors (plat->enh_desc clear)
which is dependent on the hardware.

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/E1vdtvs-00000002Gtb-2U9G@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/stmicro/stmmac/descs_com.h