[PATCH net-next 4/9] net: stmmac: descs: fix buffer 1 off-by-one error

Maxime Chevallier maxime.chevallier at bootlin.com
Wed Jan 7 01:28:30 PST 2026


Hi Russell,

On 06/01/2026 21:31, Russell King (Oracle) wrote:
> norm_set_tx_desc_len_on_ring() incorrectly tests the buffer length,
> leading to a length of 2048 being squeezed into a bitfield covering
> bits 10:0 - which results in the buffer 1 size being zero.
> 
> If this field is zero, buffer 1 is ignored, and thus is equivalent
> to transmitting a zero length buffer.
> 
> Signed-off-by: Russell King (Oracle) <rmk+kernel at armlinux.org.uk>

Should it be a fix ? I've tried to trigger the bug without success, this
seems to be fairly specific so I'm OK with it going to net-next.

Reviewed-by: Maxime Chevallier <maxime.chevallier at bootlin.com>

Maxime




More information about the linux-arm-kernel mailing list