From: Ursula Braun <>

For a memory range/skb where the last byte falls onto a page boundary
(ie. 'end' is of the form xxx...xxx001), the PFN_UP() part of the
calculation currently doesn't round up to the next PFN due to an
off-by-one error.
Thus qeth believes that the skb occupies one page less than it
actually does, and may select a IO buffer that doesn't have enough spare
buffer elements to fit all of the skb's data.
HW detects this as a malformed buffer descriptor, and raises an
exception which then triggers device recovery.

Fixes: 2863c61334aa ("qeth: refactor calculation of SBALE count")
Signed-off-by: Ursula Braun <>
Signed-off-by: Julian Wiedmann <>
 drivers/s390/net/qeth_core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index db42107bf2f5..c33fbc4c2e91 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -846,7 +846,7 @@ struct qeth_trap_id {
 static inline int qeth_get_elements_for_range(addr_t start, addr_t end)
-       return PFN_UP(end - 1) - PFN_DOWN(start);
+       return PFN_UP(end) - PFN_DOWN(start);
 static inline int qeth_get_micros(void)

Reply via email to