[Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

[Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

[xuanqiang.luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

When mapping a fragmented skb fails, count already matches the number of
successful mappings that must be undone. Decrementing it before the cleanup
loop leaves one mapping active. Reusing the descriptor then overwrites its
DMA address and loses the mapping.

Remove the extra decrement so the error path unmaps every successful
mapping.

Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index c5ae15fcdca75..3d2aba5c3f126 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
 	buffer_info->time_stamp = 0;
 	buffer_info->length = 0;
 	buffer_info->mapped_as_page = false;
-	if (count)
-		count--;
 
 	/* clear timestamp and dma mappings for remaining portion of packet */
 	while (count--) {
-- 
2.43.0

Re: [Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of xuanqiang.luo@linux.dev
> Sent: Tuesday, July 21, 2026 11:23 AM
> To: intel-wired-lan@lists.osuosl.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch;
> davem@davemloft.net; edumazet@google.com; kuba@kernel.org;
> pabeni@redhat.com; roel.kluin@gmail.com; tactii@gmail.com;
> netdev@vger.kernel.org; Xuanqiang Luo <luoxuanqiang@kylinos.cn>;
> stable@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping
> leak on Tx error
> 
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> When mapping a fragmented skb fails, count already matches the number
> of successful mappings that must be undone. Decrementing it before the
> cleanup loop leaves one mapping active. Reusing the descriptor then
> overwrites its DMA address and loses the mapping.
> 
> Remove the extra decrement so the error path unmaps every successful
> mapping.
> 
> Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of
> unsigned in *_tx_map()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> ---
>  drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c
> b/drivers/net/ethernet/intel/igbvf/netdev.c
> index c5ae15fcdca75..3d2aba5c3f126 100644
> --- a/drivers/net/ethernet/intel/igbvf/netdev.c
> +++ b/drivers/net/ethernet/intel/igbvf/netdev.c
> @@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct
> igbvf_adapter *adapter,
>  	buffer_info->time_stamp = 0;
>  	buffer_info->length = 0;
>  	buffer_info->mapped_as_page = false;
> -	if (count)
> -		count--;
> 
>  	/* clear timestamp and dma mappings for remaining portion of
> packet */
>  	while (count--) {
> --
> 2.43.0

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

Re: [Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

[Tony Nguyen]

On 7/21/2026 2:23 AM, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> When mapping a fragmented skb fails, count already matches the number of
> successful mappings that must be undone. Decrementing it before the cleanup
> loop leaves one mapping active. Reusing the descriptor then overwrites its
> DMA address and loses the mapping.
> 
> Remove the extra decrement so the error path unmaps every successful
> mapping.

Thanks for the patch Xuanqiang, but we had one submitted for this already.

https://lore.kernel.org/intel-wired-lan/20260417033452.640551-1-tactii@gmail.com/

Thanks,
Tony

> Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> ---
>   drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
>   1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
> index c5ae15fcdca75..3d2aba5c3f126 100644
> --- a/drivers/net/ethernet/intel/igbvf/netdev.c
> +++ b/drivers/net/ethernet/intel/igbvf/netdev.c
> @@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
>   	buffer_info->time_stamp = 0;
>   	buffer_info->length = 0;
>   	buffer_info->mapped_as_page = false;
> -	if (count)
> -		count--;
>   
>   	/* clear timestamp and dma mappings for remaining portion of packet */
>   	while (count--) {