korina: fix loop back of receive descriptors

After the last loop iteration, i has the value RC32434_NUM_RDS and
therefore leads to an index overflow when used afterwards to address the
last element. This is yet another another bug introduced when rewriting
parts of the driver for upstream preparation, as the original driver
used 'RC32434_NUM_RDS - 1' instead.

Signed-off-by: Phil Sutter <n0-1@freewrt.org>
Acked-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 1d6e48e13366732abf0ab8560600c476cdbf3253..67fbdf40aceb44ddd5898f609ace32c5ac15c5f8 100644 (file)
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -769,11 +769,12 @@ static void korina_alloc_ring(struct net_device *dev)
                lp->rd_ring[i].link = CPHYSADDR(&lp->rd_ring[i+1]);
        }
 
-       /* loop back */
-       lp->rd_ring[i].link = CPHYSADDR(&lp->rd_ring[0]);
-       lp->rx_next_done  = 0;
+       /* loop back receive descriptors, so the last
+        * descriptor points to the first one */
+       lp->rd_ring[i - 1].link = CPHYSADDR(&lp->rd_ring[0]);
+       lp->rd_ring[i - 1].control |= DMA_DESC_COD;
 
-       lp->rd_ring[i].control |= DMA_DESC_COD;
+       lp->rx_next_done  = 0;
        lp->rx_chain_head = 0;
        lp->rx_chain_tail = 0;
        lp->rx_chain_status = desc_empty;