[PATCH tb-next] thunderbolt: stream: unmap buffers with mapped size

[PATCH tb-next] thunderbolt: stream: unmap buffers with mapped size

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

The size passed to dma_unmap_page() must match the size used for the
corresponding dma_map_page() call.

Stream RX and TX buffers are mapped with TB_MAX_FRAME_SIZE when the
buffer pools are allocated. However, tbstream_ring_free() currently uses
tb_ring_frame_size() as the unmap size.

That helper returns the current frame payload size, not the DMA mapping
size. On the TX path, tbstream_dev_alloc_tx() stores a shorter payload
length in frame.size when the payload is smaller than TB_MAX_FRAME_SIZE.
This happens for a short final DATA frame, and also for the CLOSE frame,
which is allocated with SZ_256.

In those cases the buffer was mapped with TB_MAX_FRAME_SIZE, but
tb_ring_frame_size() returns the shorter frame payload length. This makes
the dma_unmap_page() size differ from the original dma_map_page() size.

Use TB_MAX_FRAME_SIZE when unmapping stream buffers so the unmap size
matches the DMA mapping size used by the buffer allocation paths.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/thunderbolt/stream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thunderbolt/stream.c b/drivers/thunderbolt/stream.c
index c1f5c55583d0..4cc86d8d6491 100644
--- a/drivers/thunderbolt/stream.c
+++ b/drivers/thunderbolt/stream.c
@@ -257,7 +257,7 @@ static void tbstream_ring_free(struct tbstream_ring *ring)

 		if (sf->frame.buffer_phy)
 			dma_unmap_page(dma_dev, sf->frame.buffer_phy,
-				       tb_ring_frame_size(&sf->frame), dir);
+				       TB_MAX_FRAME_SIZE, dir);
 		sf->frame.buffer_phy = 0;
 		if (sf->page)
 			__free_page(sf->page);
--
2.50.1

Re: [PATCH tb-next] thunderbolt: stream: unmap buffers with mapped size

[Mika Westerberg]

Hi,

On Thu, Jun 11, 2026 at 02:45:30PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> The size passed to dma_unmap_page() must match the size used for the
> corresponding dma_map_page() call.
> 
> Stream RX and TX buffers are mapped with TB_MAX_FRAME_SIZE when the
> buffer pools are allocated. However, tbstream_ring_free() currently uses
> tb_ring_frame_size() as the unmap size.
> 
> That helper returns the current frame payload size, not the DMA mapping
> size. On the TX path, tbstream_dev_alloc_tx() stores a shorter payload
> length in frame.size when the payload is smaller than TB_MAX_FRAME_SIZE.
> This happens for a short final DATA frame, and also for the CLOSE frame,
> which is allocated with SZ_256.
> 
> In those cases the buffer was mapped with TB_MAX_FRAME_SIZE, but
> tb_ring_frame_size() returns the shorter frame payload length. This makes
> the dma_unmap_page() size differ from the original dma_map_page() size.
> 
> Use TB_MAX_FRAME_SIZE when unmapping stream buffers so the unmap size
> matches the DMA mapping size used by the buffer allocation paths.
> 
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Applied to thunderbolt.git/fixes, thanks!