+++ /dev/null
-From c71e3a5cffd5309d7f84444df03d5b72600cc417 Mon Sep 17 00:00:00 2001
-From: Ken Milmore <ken.milmore@gmail.com>
-Date: Tue, 21 May 2024 23:45:50 +0100
-Subject: r8169: Fix possible ring buffer corruption on fragmented Tx packets.
-
-From: Ken Milmore <ken.milmore@gmail.com>
-
-commit c71e3a5cffd5309d7f84444df03d5b72600cc417 upstream.
-
-An issue was found on the RTL8125b when transmitting small fragmented
-packets, whereby invalid entries were inserted into the transmit ring
-buffer, subsequently leading to calls to dma_unmap_single() with a null
-address.
-
-This was caused by rtl8169_start_xmit() not noticing changes to nr_frags
-which may occur when small packets are padded (to work around hardware
-quirks) in rtl8169_tso_csum_v2().
-
-To fix this, postpone inspecting nr_frags until after any padding has been
-applied.
-
-Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit")
-Cc: stable@vger.kernel.org
-Signed-off-by: Ken Milmore <ken.milmore@gmail.com>
-Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
-Link: https://lore.kernel.org/r/27ead18b-c23d-4f49-a020-1fc482c5ac95@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/net/ethernet/realtek/r8169_main.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/ethernet/realtek/r8169_main.c
-+++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -4279,11 +4279,11 @@ static void rtl8169_doorbell(struct rtl8
- static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
- struct net_device *dev)
- {
-- unsigned int frags = skb_shinfo(skb)->nr_frags;
- struct rtl8169_private *tp = netdev_priv(dev);
- unsigned int entry = tp->cur_tx % NUM_TX_DESC;
- struct TxDesc *txd_first, *txd_last;
- bool stop_queue, door_bell;
-+ unsigned int frags;
- u32 opts[2];
-
- txd_first = tp->TxDescArray + entry;
-@@ -4309,6 +4309,7 @@ static netdev_tx_t rtl8169_start_xmit(st
- entry, false)))
- goto err_dma_0;
-
-+ frags = skb_shinfo(skb)->nr_frags;
- if (frags) {
- if (rtl8169_xmit_frags(tp, skb, opts, entry))
- goto err_dma_1;