[PATCH net v2] net: ena: avoid double-counting TX DMA mappings on failure

[PATCH net v2] net: ena: avoid double-counting TX DMA mappings on failure

[Avi Weiss]

ena_tx_map_skb() increments tx_info->num_of_bufs after each successful
DMA mapping. If a later fragment mapping fails, the error path adds the
fragment index to this count before calling ena_unmap_tx_buff(). This
can cause DMA unmapping of buffers that were never mapped and
out-of-bounds access to the buffer array.

Remove the extra increment so that cleanup uses only the number of
successfully mapped buffers.

Discovered by comparing the in-tree ENA driver with Amazon's standalone
ENA driver.

Compiled with W=1 under x86_64 defconfig and allmodconfig configurations.
Fixes: 38005ca816a7 ("net: ena: add functions for handling Low Latency Queues in ena_netdev")
Signed-off-by: Evgeny Ostrovsky <evostrov@amazon.com>
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
v2:
  - add Evgeny Ostrovsky's Signed-off-by

 drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 7eb6456ed0d5..e0df628e1df6 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2608,7 +2608,6 @@ static int ena_tx_map_skb(struct ena_ring *tx_ring,
 
 	tx_info->skb = NULL;
 
-	tx_info->num_of_bufs += i;
 	ena_unmap_tx_buff(tx_ring, tx_info);
 
 	return -EINVAL;

base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
-- 
2.43.0

RE: [PATCH net v2] net: ena: avoid double-counting TX DMA mappings on failure

[Kiyanovski, Arthur]

> -----Original Message-----
> From: Avi Weiss <thnkslprpt@gmail.com>
> Sent: Friday, November 13, 2026 10:57 PM
> To: netdev@vger.kernel.org
> Cc: Kiyanovski, Arthur <akiyano@amazon.com>; Arinzon, David
> <darinzon@amazon.com>; andrew+netdev@lunn.ch; davem@davemloft.net;
> edumazet@kernel.org; kuba@kernel.org; pabeni@redhat.com; Ostrovsky,
> Evgeny <evostrov@amazon.com>; Avi Weiss <thnkslprpt@gmail.com>
> Subject: [EXTERNAL] [PATCH net v2] net: ena: avoid double-counting TX DMA
> mappings on failure
> 
> CAUTION: This email originated from outside of the organization. Do not click
> links or open attachments unless you can confirm the sender and know the
> content is safe.
> 
> 
> 
> ena_tx_map_skb() increments tx_info->num_of_bufs after each successful
> DMA mapping. If a later fragment mapping fails, the error path adds the
> fragment index to this count before calling ena_unmap_tx_buff(). This can
> cause DMA unmapping of buffers that were never mapped and out-of-
> bounds access to the buffer array.
> 
> Remove the extra increment so that cleanup uses only the number of
> successfully mapped buffers.
> 
> Discovered by comparing the in-tree ENA driver with Amazon's standalone
> ENA driver.
> 
> Compiled with W=1 under x86_64 defconfig and allmodconfig configurations.
> Fixes: 38005ca816a7 ("net: ena: add functions for handling Low Latency
> Queues in ena_netdev")
> Signed-off-by: Evgeny Ostrovsky <evostrov@amazon.com>
> Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
> ---
> v2:
>   - add Evgeny Ostrovsky's Signed-off-by
> 
>  drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c
> b/drivers/net/ethernet/amazon/ena/ena_netdev.c
> index 7eb6456ed0d5..e0df628e1df6 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
> @@ -2608,7 +2608,6 @@ static int ena_tx_map_skb(struct ena_ring *tx_ring,
> 
>         tx_info->skb = NULL;
> 
> -       tx_info->num_of_bufs += i;
>         ena_unmap_tx_buff(tx_ring, tx_info);
> 
>         return -EINVAL;
> 
> base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
> --
> 2.43.0


Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com>