* [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error
@ 2026-07-21 9:23 xuanqiang.luo
0 siblings, 0 replies; only message in thread
From: xuanqiang.luo @ 2026-07-21 9:23 UTC (permalink / raw)
To: intel-wired-lan
Cc: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev, davem,
edumazet, kuba, pabeni, roel.kluin, tactii, netdev, Xuanqiang Luo,
stable
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
When mapping a fragmented skb fails, count already matches the number of
successful mappings that must be undone. Decrementing it before the cleanup
loop leaves one mapping active. Reusing the descriptor then overwrites its
DMA address and loses the mapping.
Remove the extra decrement so the error path unmaps every successful
mapping.
Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index c5ae15fcdca75..3d2aba5c3f126 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
buffer_info->time_stamp = 0;
buffer_info->length = 0;
buffer_info->mapped_as_page = false;
- if (count)
- count--;
/* clear timestamp and dma mappings for remaining portion of packet */
while (count--) {
--
2.43.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-21 9:25 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-21 9:23 [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error xuanqiang.luo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox