[lvc-project] [PATCH net] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[Denis Arefev]

unmap_partial_tx_skb() walks the TX ring entries between
first_entry and entry to release the DMA mappings of the
fragments that were mapped successfully before a mapping error,
but it never advances first_entry inside the loop. Whenever the
failed fragment is not the first one, entry is ahead of
first_entry and the loop condition first_entry != entry never
becomes false, so the function spins forever.

The function is called from happy_meal_start_xmit() with
hp->happy_lock held and interrupts disabled, so the infinite
loop leads to a hard lockup.

Advance first_entry with NEXT_TX() at the end of the loop body.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: ec1f1276022e ("sunhme: Add DMA mapping error checks.")
Cc: stable at vger.kernel.org
Signed-off-by: Denis Arefev <arefev at swemel.ru>
---
 drivers/net/ethernet/sun/sunhme.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index a70f704eb9f3..544eb43af125 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1965,6 +1965,7 @@ static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping,
 		len = hme_read_desc32(hp, &this->tx_flags);
 		len &= TXFLAG_SIZE;
 		dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE);
+		first_entry = NEXT_TX(first_entry);
 	}
 }
 
-- 
2.43.0