[PATCH iwl-net v2 0/2] e1000e: fix Rx DMA error handling

[PATCH iwl-net v2 0/2] e1000e: fix Rx DMA error handling

[Matt Vollrath]

Fix some longstanding bugs in Rx DMA error handling.

These two patches eliminate some conditions which would result in
DMA_MAPPING_ERROR being sent to h/w or to dma_unmap_page() or
dma_unmap_single(). A teardown leak in the packet-splitting path is also
fixed by a necessary refactor.

v2:
* Renamed series from "e1000e: fix Rx bugs"
* Removed RXALL buffer overrun fix from the series.
  RXALL bugs will be fixed in a separate series.
* Reworded patch commit messages.

Matt Vollrath (2):
  e1000e: fix Rx skb DMA map error sentinel
  e1000e: fix ps_pages DMA map error sentinel

 drivers/net/ethernet/intel/e1000e/netdev.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)


base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
-- 
2.43.0

[PATCH iwl-net v2 1/2] e1000e: fix Rx skb DMA map error sentinel

[Matt Vollrath]

Upon encountering a DMA_MAPPING_ERROR during skb allocation and mapping,
the driver would leave DMA_MAPPING_ERROR in the buffer_info->dma field.
This would lead several buffer_info->dma == 0 conditions down unwanted
paths:

* In e1000_alloc_jumbo_rx_buffers(), it would not re-attempt the failed
  mapping and instead write DMA_MAPPING_ERROR to the h/w descriptor on
  the next allocation call. On cleaning or teardown it would attempt to
  dma_unmap_page() DMA_MAPPING_ERROR. This case would only be
  reachable at MTU > 1518 and page size > 16K.
* In e1000_clean_rx_ring(), it would attempt to dma_unmap_page/single()
  DMA_MAPPING_ERROR (unless cleaned by the jumbo path first). This case
  would be reachable at any combination of MTU and page size.

Use buffer_info->dma = 0 as the sentinel for "DMA is not mapped." Set it
immediately upon detecting the failure.

The map error value was 0 on some platforms (including most common x86)
until error values were unified to DMA_MAPPING_ERROR in v4.20/v5.0.
Since then the error handling in this driver has been incorrect on all
platforms.

Signed-off-by: Matt Vollrath <tactii@gmail.com>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
Cc: stable@vger.kernel.org
---
v2:
* Add history blurb to description.
---
 drivers/net/ethernet/intel/e1000e/netdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 844f31ab37ad..26f45ee8c7e7 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -691,6 +691,7 @@ static void e1000_alloc_rx_buffers(struct e1000_ring *rx_ring,
 						  adapter->rx_buffer_len,
 						  DMA_FROM_DEVICE);
 		if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+			buffer_info->dma = 0;
 			dev_err(&pdev->dev, "Rx DMA map failed\n");
 			adapter->rx_dma_failed++;
 			break;
@@ -791,6 +792,7 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_ring *rx_ring,
 						  adapter->rx_ps_bsize0,
 						  DMA_FROM_DEVICE);
 		if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+			buffer_info->dma = 0;
 			dev_err(&pdev->dev, "Rx DMA map failed\n");
 			adapter->rx_dma_failed++;
 			/* cleanup skb */
@@ -877,6 +879,7 @@ static void e1000_alloc_jumbo_rx_buffers(struct e1000_ring *rx_ring,
 							PAGE_SIZE,
 							DMA_FROM_DEVICE);
 			if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+				buffer_info->dma = 0;
 				adapter->alloc_rx_buff_failed++;
 				break;
 			}

base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
-- 
2.43.0

Re: [PATCH iwl-net v2 1/2] e1000e: fix Rx skb DMA map error sentinel

[Ruinskiy, Dima]

On 13/09/2026 20:15, Matt Vollrath wrote:
> Upon encountering a DMA_MAPPING_ERROR during skb allocation and mapping,
> the driver would leave DMA_MAPPING_ERROR in the buffer_info->dma field.
> This would lead several buffer_info->dma == 0 conditions down unwanted
> paths:
> 
> * In e1000_alloc_jumbo_rx_buffers(), it would not re-attempt the failed
>    mapping and instead write DMA_MAPPING_ERROR to the h/w descriptor on
>    the next allocation call. On cleaning or teardown it would attempt to
>    dma_unmap_page() DMA_MAPPING_ERROR. This case would only be
>    reachable at MTU > 1518 and page size > 16K.
> * In e1000_clean_rx_ring(), it would attempt to dma_unmap_page/single()
>    DMA_MAPPING_ERROR (unless cleaned by the jumbo path first). This case
>    would be reachable at any combination of MTU and page size.
> 
> Use buffer_info->dma = 0 as the sentinel for "DMA is not mapped." Set it
> immediately upon detecting the failure.
> 
> The map error value was 0 on some platforms (including most common x86)
> until error values were unified to DMA_MAPPING_ERROR in v4.20/v5.0.
> Since then the error handling in this driver has been incorrect on all
> platforms.
> 
> Signed-off-by: Matt Vollrath <tactii@gmail.com>
> Suggested-by: Jakub Kicinski <kuba@kernel.org>
> Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
> Cc: stable@vger.kernel.org
> ---
> v2:
> * Add history blurb to description.
> ---
>   drivers/net/ethernet/intel/e1000e/netdev.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
> index 844f31ab37ad..26f45ee8c7e7 100644
> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> @@ -691,6 +691,7 @@ static void e1000_alloc_rx_buffers(struct e1000_ring *rx_ring,
>   						  adapter->rx_buffer_len,
>   						  DMA_FROM_DEVICE);
>   		if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
> +			buffer_info->dma = 0;
>   			dev_err(&pdev->dev, "Rx DMA map failed\n");
>   			adapter->rx_dma_failed++;
>   			break;
> @@ -791,6 +792,7 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_ring *rx_ring,
>   						  adapter->rx_ps_bsize0,
>   						  DMA_FROM_DEVICE);
>   		if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
> +			buffer_info->dma = 0;
>   			dev_err(&pdev->dev, "Rx DMA map failed\n");
>   			adapter->rx_dma_failed++;
>   			/* cleanup skb */
> @@ -877,6 +879,7 @@ static void e1000_alloc_jumbo_rx_buffers(struct e1000_ring *rx_ring,
>   							PAGE_SIZE,
>   							DMA_FROM_DEVICE);
>   			if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
> +				buffer_info->dma = 0;
>   				adapter->alloc_rx_buff_failed++;
>   				break;
>   			}
> 
> base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>

Re: [PATCH iwl-net v2 1/2] e1000e: fix Rx skb DMA map error sentinel

[Kadosh, MoriyaX]

On 05/10/2026 21:11, Ruinskiy, Dima wrote:
> On 13/09/2026 20:15, Matt Vollrath wrote:
>> Upon encountering a DMA_MAPPING_ERROR during skb allocation and mapping,
>> the driver would leave DMA_MAPPING_ERROR in the buffer_info->dma field.
>> This would lead several buffer_info->dma == 0 conditions down unwanted
>> paths:
>>
>> * In e1000_alloc_jumbo_rx_buffers(), it would not re-attempt the failed
>>    mapping and instead write DMA_MAPPING_ERROR to the h/w descriptor on
>>    the next allocation call. On cleaning or teardown it would attempt to
>>    dma_unmap_page() DMA_MAPPING_ERROR. This case would only be
>>    reachable at MTU > 1518 and page size > 16K.
>> * In e1000_clean_rx_ring(), it would attempt to dma_unmap_page/single()
>>    DMA_MAPPING_ERROR (unless cleaned by the jumbo path first). This case
>>    would be reachable at any combination of MTU and page size.
>>
>> Use buffer_info->dma = 0 as the sentinel for "DMA is not mapped." Set it
>> immediately upon detecting the failure.
>>
>> The map error value was 0 on some platforms (including most common x86)
>> until error values were unified to DMA_MAPPING_ERROR in v4.20/v5.0.
>> Since then the error handling in this driver has been incorrect on all
>> platforms.
>>
>> Signed-off-by: Matt Vollrath <tactii@gmail.com>
>> Suggested-by: Jakub Kicinski <kuba@kernel.org>
>> Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver 
>> (currently for ICH9 devices only)")
>> Cc: stable@vger.kernel.org
>> ---
>> v2:
>> * Add history blurb to description.
>> ---
>>   drivers/net/ethernet/intel/e1000e/netdev.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ 
>> ethernet/intel/e1000e/netdev.c
>> index 844f31ab37ad..26f45ee8c7e7 100644
>> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
>> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
>> @@ -691,6 +691,7 @@ static void e1000_alloc_rx_buffers(struct 
>> e1000_ring *rx_ring,
>>                             adapter->rx_buffer_len,
>>                             DMA_FROM_DEVICE);
>>           if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
>> +            buffer_info->dma = 0;
>>               dev_err(&pdev->dev, "Rx DMA map failed\n");
>>               adapter->rx_dma_failed++;
>>               break;
>> @@ -791,6 +792,7 @@ static void e1000_alloc_rx_buffers_ps(struct 
>> e1000_ring *rx_ring,
>>                             adapter->rx_ps_bsize0,
>>                             DMA_FROM_DEVICE);
>>           if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
>> +            buffer_info->dma = 0;
>>               dev_err(&pdev->dev, "Rx DMA map failed\n");
>>               adapter->rx_dma_failed++;
>>               /* cleanup skb */
>> @@ -877,6 +879,7 @@ static void e1000_alloc_jumbo_rx_buffers(struct 
>> e1000_ring *rx_ring,
>>                               PAGE_SIZE,
>>                               DMA_FROM_DEVICE);
>>               if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
>> +                buffer_info->dma = 0;
>>                   adapter->alloc_rx_buff_failed++;
>>                   break;
>>               }
>>
>> base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com>

[PATCH iwl-net v2 2/2] e1000e: fix ps_pages DMA map error sentinel

[Matt Vollrath]

While allocating packet-split buffer pages, a failed DMA mapping would
leave DMA_MAPPING_ERROR in the ps_page->dma field.

This would have two consequences:
* The next attempt to allocate that buffer would write DMA_MAPPING_ERROR
  to h/w if all pages are allocated. If the h/w uses that buffer and is
  handling a frame large enough to touch the affected page, it would
  cause a DMA fault and be dropped. The driver would then call
  dma_unmap_page() on DMA_MAPPING_ERROR and unknowingly send the
  uninitialized page up the stack as part of the frame payload.
* On ring teardown, dma_unmap_page() would be called on
  DMA_MAPPING_ERROR.

This condition is only reachable when MTU > 1500 and PAGE_SIZE <= 16K.

Fix this by setting ps_page->dma = 0 upon mapping failure and separately
testing ->page and ->dma during allocation and teardown.

The rewrite of the ps_pages section of e1000_clean_rx_ring was necessary
to recognize the case of an allocated page without a valid DMA mapping.
It also fixes a separate bug which would potentially leak pages on ring
teardown. The cleaner stops cleaning pages when h/w reported that it did
not write to a page in the sequence, leaving the following pages
allocated and mapped. The teardown would then break early and leak the
unused mapped pages. If the ring is re-constructed by down/up with
similar configuration, it would reclaim those lost pages. This would
only affect configurations with rx_ps_pages >= 2 (MTU > PAGE_SIZE) and
the same condition of MTU > 1500 and PAGE_SIZE <= 16K.

Signed-off-by: Matt Vollrath <tactii@gmail.com>
Assisted-by: Claude:claude-5-fable
Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
Cc: stable@vger.kernel.org
---
v2:
* Reword last paragraph of description.
---
 drivers/net/ethernet/intel/e1000e/netdev.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 26f45ee8c7e7..063fc8cd2673 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -759,12 +759,15 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_ring *rx_ring,
 					adapter->alloc_rx_buff_failed++;
 					goto no_buffers;
 				}
+			}
+			if (!ps_page->dma) {
 				ps_page->dma = dma_map_page(&pdev->dev,
 							    ps_page->page,
 							    0, PAGE_SIZE,
 							    DMA_FROM_DEVICE);
 				if (dma_mapping_error(&pdev->dev,
 						      ps_page->dma)) {
+					ps_page->dma = 0;
 					dev_err(&adapter->pdev->dev,
 						"Rx DMA page map failed\n");
 					adapter->rx_dma_failed++;
@@ -1722,13 +1725,15 @@ static void e1000_clean_rx_ring(struct e1000_ring *rx_ring)
 
 		for (j = 0; j < PS_PAGE_BUFFERS; j++) {
 			ps_page = &buffer_info->ps_pages[j];
-			if (!ps_page->page)
-				break;
-			dma_unmap_page(&pdev->dev, ps_page->dma, PAGE_SIZE,
-				       DMA_FROM_DEVICE);
-			ps_page->dma = 0;
-			put_page(ps_page->page);
-			ps_page->page = NULL;
+			if (ps_page->dma) {
+				dma_unmap_page(&pdev->dev, ps_page->dma,
+					       PAGE_SIZE, DMA_FROM_DEVICE);
+				ps_page->dma = 0;
+			}
+			if (ps_page->page) {
+				put_page(ps_page->page);
+				ps_page->page = NULL;
+			}
 		}
 	}
 
-- 
2.43.0

Re: [PATCH iwl-net v2 2/2] e1000e: fix ps_pages DMA map error sentinel

[Ruinskiy, Dima]

On 13/09/2026 20:15, Matt Vollrath wrote:
> While allocating packet-split buffer pages, a failed DMA mapping would
> leave DMA_MAPPING_ERROR in the ps_page->dma field.
> 
> This would have two consequences:
> * The next attempt to allocate that buffer would write DMA_MAPPING_ERROR
>    to h/w if all pages are allocated. If the h/w uses that buffer and is
>    handling a frame large enough to touch the affected page, it would
>    cause a DMA fault and be dropped. The driver would then call
>    dma_unmap_page() on DMA_MAPPING_ERROR and unknowingly send the
>    uninitialized page up the stack as part of the frame payload.
> * On ring teardown, dma_unmap_page() would be called on
>    DMA_MAPPING_ERROR.
> 
> This condition is only reachable when MTU > 1500 and PAGE_SIZE <= 16K.
> 
> Fix this by setting ps_page->dma = 0 upon mapping failure and separately
> testing ->page and ->dma during allocation and teardown.
> 
> The rewrite of the ps_pages section of e1000_clean_rx_ring was necessary
> to recognize the case of an allocated page without a valid DMA mapping.
> It also fixes a separate bug which would potentially leak pages on ring
> teardown. The cleaner stops cleaning pages when h/w reported that it did
> not write to a page in the sequence, leaving the following pages
> allocated and mapped. The teardown would then break early and leak the
> unused mapped pages. If the ring is re-constructed by down/up with
> similar configuration, it would reclaim those lost pages. This would
> only affect configurations with rx_ps_pages >= 2 (MTU > PAGE_SIZE) and
> the same condition of MTU > 1500 and PAGE_SIZE <= 16K.
> 
> Signed-off-by: Matt Vollrath <tactii@gmail.com>
> Assisted-by: Claude:claude-5-fable
> Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
> Cc: stable@vger.kernel.org
> ---
> v2:
> * Reword last paragraph of description.
> ---
>   drivers/net/ethernet/intel/e1000e/netdev.c | 19 ++++++++++++-------
>   1 file changed, 12 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
> index 26f45ee8c7e7..063fc8cd2673 100644
> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> @@ -759,12 +759,15 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_ring *rx_ring,
>   					adapter->alloc_rx_buff_failed++;
>   					goto no_buffers;
>   				}
> +			}
> +			if (!ps_page->dma) {
>   				ps_page->dma = dma_map_page(&pdev->dev,
>   							    ps_page->page,
>   							    0, PAGE_SIZE,
>   							    DMA_FROM_DEVICE);
>   				if (dma_mapping_error(&pdev->dev,
>   						      ps_page->dma)) {
> +					ps_page->dma = 0;
>   					dev_err(&adapter->pdev->dev,
>   						"Rx DMA page map failed\n");
>   					adapter->rx_dma_failed++;
> @@ -1722,13 +1725,15 @@ static void e1000_clean_rx_ring(struct e1000_ring *rx_ring)
>   
>   		for (j = 0; j < PS_PAGE_BUFFERS; j++) {
>   			ps_page = &buffer_info->ps_pages[j];
> -			if (!ps_page->page)
> -				break;
> -			dma_unmap_page(&pdev->dev, ps_page->dma, PAGE_SIZE,
> -				       DMA_FROM_DEVICE);
> -			ps_page->dma = 0;
> -			put_page(ps_page->page);
> -			ps_page->page = NULL;
> +			if (ps_page->dma) {
> +				dma_unmap_page(&pdev->dev, ps_page->dma,
> +					       PAGE_SIZE, DMA_FROM_DEVICE);
> +				ps_page->dma = 0;
> +			}
> +			if (ps_page->page) {
> +				put_page(ps_page->page);
> +				ps_page->page = NULL;
> +			}
>   		}
>   	}
>   
Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>

Re: [PATCH iwl-net v2 2/2] e1000e: fix ps_pages DMA map error sentinel

[Kadosh, MoriyaX]

On 05/10/2026 21:11, Ruinskiy, Dima wrote:
> On 13/09/2026 20:15, Matt Vollrath wrote:
>> While allocating packet-split buffer pages, a failed DMA mapping would
>> leave DMA_MAPPING_ERROR in the ps_page->dma field.
>>
>> This would have two consequences:
>> * The next attempt to allocate that buffer would write DMA_MAPPING_ERROR
>>    to h/w if all pages are allocated. If the h/w uses that buffer and is
>>    handling a frame large enough to touch the affected page, it would
>>    cause a DMA fault and be dropped. The driver would then call
>>    dma_unmap_page() on DMA_MAPPING_ERROR and unknowingly send the
>>    uninitialized page up the stack as part of the frame payload.
>> * On ring teardown, dma_unmap_page() would be called on
>>    DMA_MAPPING_ERROR.
>>
>> This condition is only reachable when MTU > 1500 and PAGE_SIZE <= 16K.
>>
>> Fix this by setting ps_page->dma = 0 upon mapping failure and separately
>> testing ->page and ->dma during allocation and teardown.
>>
>> The rewrite of the ps_pages section of e1000_clean_rx_ring was necessary
>> to recognize the case of an allocated page without a valid DMA mapping.
>> It also fixes a separate bug which would potentially leak pages on ring
>> teardown. The cleaner stops cleaning pages when h/w reported that it did
>> not write to a page in the sequence, leaving the following pages
>> allocated and mapped. The teardown would then break early and leak the
>> unused mapped pages. If the ring is re-constructed by down/up with
>> similar configuration, it would reclaim those lost pages. This would
>> only affect configurations with rx_ps_pages >= 2 (MTU > PAGE_SIZE) and
>> the same condition of MTU > 1500 and PAGE_SIZE <= 16K.
>>
>> Signed-off-by: Matt Vollrath <tactii@gmail.com>
>> Assisted-by: Claude:claude-5-fable
>> Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver 
>> (currently for ICH9 devices only)")
>> Cc: stable@vger.kernel.org
>> ---
>> v2:
>> * Reword last paragraph of description.
>> ---
>>   drivers/net/ethernet/intel/e1000e/netdev.c | 19 ++++++++++++-------
>>   1 file changed, 12 insertions(+), 7 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ 
>> ethernet/intel/e1000e/netdev.c
>> index 26f45ee8c7e7..063fc8cd2673 100644
>> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
>> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
>> @@ -759,12 +759,15 @@ static void e1000_alloc_rx_buffers_ps(struct 
>> e1000_ring *rx_ring,
>>                       adapter->alloc_rx_buff_failed++;
>>                       goto no_buffers;
>>                   }
>> +            }
>> +            if (!ps_page->dma) {
>>                   ps_page->dma = dma_map_page(&pdev->dev,
>>                                   ps_page->page,
>>                                   0, PAGE_SIZE,
>>                                   DMA_FROM_DEVICE);
>>                   if (dma_mapping_error(&pdev->dev,
>>                                 ps_page->dma)) {
>> +                    ps_page->dma = 0;
>>                       dev_err(&adapter->pdev->dev,
>>                           "Rx DMA page map failed\n");
>>                       adapter->rx_dma_failed++;
>> @@ -1722,13 +1725,15 @@ static void e1000_clean_rx_ring(struct 
>> e1000_ring *rx_ring)
>>           for (j = 0; j < PS_PAGE_BUFFERS; j++) {
>>               ps_page = &buffer_info->ps_pages[j];
>> -            if (!ps_page->page)
>> -                break;
>> -            dma_unmap_page(&pdev->dev, ps_page->dma, PAGE_SIZE,
>> -                       DMA_FROM_DEVICE);
>> -            ps_page->dma = 0;
>> -            put_page(ps_page->page);
>> -            ps_page->page = NULL;
>> +            if (ps_page->dma) {
>> +                dma_unmap_page(&pdev->dev, ps_page->dma,
>> +                           PAGE_SIZE, DMA_FROM_DEVICE);
>> +                ps_page->dma = 0;
>> +            }
>> +            if (ps_page->page) {
>> +                put_page(ps_page->page);
>> +                ps_page->page = NULL;
>> +            }
>>           }
>>       }
> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com>

Re: [PATCH iwl-net v2 0/2] e1000e: fix Rx DMA error handling

[Simon Horman]

On Sun, Sep 13, 2026 at 01:15:53PM -0400, Matt Vollrath wrote:
> Fix some longstanding bugs in Rx DMA error handling.
> 
> These two patches eliminate some conditions which would result in
> DMA_MAPPING_ERROR being sent to h/w or to dma_unmap_page() or
> dma_unmap_single(). A teardown leak in the packet-splitting path is also
> fixed by a necessary refactor.
> 
> v2:
> * Renamed series from "e1000e: fix Rx bugs"
> * Removed RXALL buffer overrun fix from the series.
>   RXALL bugs will be fixed in a separate series.
> * Reworded patch commit messages.

For the series:

Reviewed-by: Simon Horman <horms@kernel.org>