diff options
| author | Matt Carlson <mcarlson@broadcom.com> | 2011-06-02 15:01:39 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-06-03 09:01:30 +0200 |
| commit | 9a2e0fb0893ddf595d0a372e681f5b98017c6d90 (patch) | |
| tree | fc32f2ae2fefe55bfe5b3381629b33550f7adea6 /drivers/net/tg3.c | |
| parent | net: tracepoint of net_dev_xmit sees freed skb and causes panic (diff) | |
| download | linux-9a2e0fb0893ddf595d0a372e681f5b98017c6d90.tar.xz linux-9a2e0fb0893ddf595d0a372e681f5b98017c6d90.zip | |
tg3: Fix tg3_skb_error_unmap()
This function attempts to free one fragment beyond the number of
fragments that were actually mapped. This patch brings back the limit
to the correct spot.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
| -rw-r--r-- | drivers/net/tg3.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index f4b01c638a33..a1f9f9eef37d 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c @@ -5774,7 +5774,7 @@ static void tg3_skb_error_unmap(struct tg3_napi *tnapi, dma_unmap_addr(txb, mapping), skb_headlen(skb), PCI_DMA_TODEVICE); - for (i = 0; i <= last; i++) { + for (i = 0; i < last; i++) { skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; entry = NEXT_TX(entry); |