From 9a2e0fb0893ddf595d0a372e681f5b98017c6d90 Mon Sep 17 00:00:00 2001 From: Matt Carlson Date: Thu, 2 Jun 2011 13:01:39 +0000 Subject: tg3: Fix tg3_skb_error_unmap() This function attempts to free one fragment beyond the number of fragments that were actually mapped. This patch brings back the limit to the correct spot. Signed-off-by: Matt Carlson Tested-by: Alex Williamson Signed-off-by: David S. Miller --- drivers/net/tg3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index f4b01c638a33..a1f9f9eef37d 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c @@ -5774,7 +5774,7 @@ static void tg3_skb_error_unmap(struct tg3_napi *tnapi, dma_unmap_addr(txb, mapping), skb_headlen(skb), PCI_DMA_TODEVICE); - for (i = 0; i <= last; i++) { + for (i = 0; i < last; i++) { skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; entry = NEXT_TX(entry); -- cgit v1.2.3