[Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

[email protected] Tue, 21 Jul 2026 17:23:23 +0800
Newsgroups org.osuosl.intel-wired-lan,org.kernel.vger.netdev,org.kernel.vger.stable
Message-ID <[email protected]>
From: Xuanqiang Luo <[email protected]>

When mapping a fragmented skb fails, count already matches the number of
successful mappings that must be undone. Decrementing it before the cleanup
loop leaves one mapping active. Reusing the descriptor then overwrites its
DMA address and loses the mapping.

Remove the extra decrement so the error path unmaps every successful
mapping.

Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
Cc: [email protected]
Signed-off-by: Xuanqiang Luo <[email protected]>
---
 drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index c5ae15fcdca75..3d2aba5c3f126 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
 	buffer_info->time_stamp = 0;
 	buffer_info->length = 0;
 	buffer_info->mapped_as_page = false;
-	if (count)
-		count--;
 
 	/* clear timestamp and dma mappings for remaining portion of packet */
 	while (count--) {
-- 
2.43.0