Thread (4 messages) flat view 4 messages, 1 author, 1d ago
WARM1d

[PATCH ethtool 1/3] ethtool: fbnic: fix off-by-one shift in reg dump parser

From: Mohsin Bashir <hidden>
Date: 2026-09-02 23:07:46
Subsystem: the rest · Maintainer: Linus Torvalds

From: Mohsin Bashir <redacted>

The INTR, INTR_CQ, QM_TX, QM_RX, TCE and TCE_RAM section parsers skipped
the first register value and stopped before the final register. Every
decoded value was consequently associated with the preceding CSR while
the section length still appeared valid.

Consume the first value without an extra increment and iterate through
the inclusive section end.

Fixes: a38a2d3a8271 ("ethtool: fbnic: ethtool dump parser")
Signed-off-by: Mohsin Bashir <redacted>
---
 fbnic.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)
diff --git a/fbnic.c b/fbnic.c
index a5b1d76..e368c60 100644
--- a/fbnic.c
+++ b/fbnic.c
@@ -5598,8 +5598,7 @@ static int fbnic_dump_fb_nic_intr_global(uint32_t **regs_buffp,
 		return -1;
 	}
 
-	regs_buff++;
-	for (csr_offset = csr_start_addr; csr_offset < csr_end_addr;
+	for (csr_offset = csr_start_addr; csr_offset <= csr_end_addr;
 		csr_offset += k) {
 		k = 1;
 		reg_val = *regs_buff;
@@ -5728,9 +5727,8 @@ static int fbnic_dump_fb_nic_intr_msix(uint32_t **regs_buffp,
 	 * from a different register array at the same index.
 	 * Every 4th register belongs to one register array
 	 */
-	regs_buff++;
 	for (csr_offset = csr_start_addr;
-	     csr_offset < csr_end_addr; csr_offset++) {
+	     csr_offset <= csr_end_addr; csr_offset++) {
 
 		i = csr_offset - *section_start;
 		reg_val = *regs_buff;
@@ -5818,9 +5816,8 @@ static int fbnic_dump_fb_nic_qm_tx_global(uint32_t **regs_buffp,
 		return -1;
 	}
 
-	regs_buff++;
 	for (csr_offset = csr_start_addr;
-		csr_offset < csr_end_addr; csr_offset++) {
+		csr_offset <= csr_end_addr; csr_offset++) {
 		reg_val = *regs_buff;
 		switch (csr_offset) {
 		case REGISTER_RANGE(FBNIC_QM_TWQ_IDLE):
@@ -6301,9 +6298,8 @@ static int fbnic_dump_fb_nic_qm_rx_global(uint32_t **regs_buffp,
 		return -1;
 	}
 
-	regs_buff++;
 	for (csr_offset = csr_start_addr;
-		csr_offset < csr_end_addr; csr_offset++) {
+		csr_offset <= csr_end_addr; csr_offset++) {
 
 		reg_val = *regs_buff;
 		switch (csr_offset) {
@@ -6750,9 +6746,8 @@ static int fbnic_dump_fb_nic_tce(uint32_t **regs_buffp,
 		return -1;
 	}
 
-	regs_buff++;
 	for (csr_offset = csr_start_addr;
-	     csr_offset < csr_end_addr; csr_offset++) {
+	     csr_offset <= csr_end_addr; csr_offset++) {
 
 		reg_val = *regs_buff;
 		switch (csr_offset) {
@@ -7450,9 +7445,8 @@ static int fbnic_dump_fb_nic_tce_ram(uint32_t **regs_buffp,
 		return -1;
 	}
 
-	regs_buff++;
 	for (csr_offset = csr_start_addr;
-	     csr_offset < csr_end_addr; csr_offset++) {
+	     csr_offset <= csr_end_addr; csr_offset++) {
 
 		reg_val = *regs_buff;
 		switch (csr_offset) {
-- 
2.53.0-Meta
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help