eth: bnxt: fix missing ring index trim on error path

JIRA: https://issues.redhat.com/browse/RHEL-106550
CVE: CVE-2025-37873

commit 12f2d03
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Mon Apr 14 07:32:10 2025 -0700

    eth: bnxt: fix missing ring index trim on error path

    Commit under Fixes converted tx_prod to be free running but missed
    masking it on the Tx error path. This crashes on error conditions,
    for example when DMA mapping fails.

    Fixes: 6d1add9 ("bnxt_en: Modify TX ring indexing logic.")
    Reviewed-by: Michael Chan <michael.chan@broadcom.com>
    Link: https://patch.msgid.link/20250414143210.458625-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Author: michich

drivers/net/ethernet/broadcom/bnxt/bnxt.c

@@ -783,15 +783,15 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	dev_kfree_skb_any(skb);
 tx_kick_pending:
 	if (BNXT_TX_PTP_IS_SET(lflags)) {
-		txr->tx_buf_ring[txr->tx_prod].is_ts_pkt = 0;
+		txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].is_ts_pkt = 0;
 		atomic64_inc(&bp->ptp_cfg->stats.ts_err);
 		if (!(bp->fw_cap & BNXT_FW_CAP_TX_TS_CMP))
 			/* set SKB to err so PTP worker will clean up */
 			ptp->txts_req[txts_prod].tx_skb = ERR_PTR(-EIO);
 	}
 	if (txr->kick_pending)
 		bnxt_txr_db_kick(bp, txr, txr->tx_prod);
-	txr->tx_buf_ring[txr->tx_prod].skb = NULL;
+	txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].skb = NULL;
 	dev_core_stats_tx_dropped_inc(dev);
 	return NETDEV_TX_OK;
 }