Re: [Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

"Loktionov, Aleksandr" <[email protected]> Thu, 23 Jul 2026 09:16:21 +0000
Newsgroups org.osuosl.intel-wired-lan,org.kernel.vger.netdev,org.kernel.vger.stable
Message-ID <IA3PR11MB8986476BDAE21FAC38BE45EFE5C02@IA3PR11MB8986.namprd11.prod.outlook.com>

> -----Original Message-----
> From: Intel-wired-lan <[email protected]> On Behalf
> Of [email protected]
> Sent: Tuesday, July 21, 2026 11:23 AM
> To: [email protected]
> Cc: Nguyen, Anthony L <[email protected]>; Kitszel,
> Przemyslaw <[email protected]>; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; Xuanqiang Luo <[email protected]>;
> [email protected]
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping
> leak on Tx error
> 
> From: Xuanqiang Luo <[email protected]>
> 
> When mapping a fragmented skb fails, count already matches the number
> of successful mappings that must be undone. Decrementing it before the
> cleanup loop leaves one mapping active. Reusing the descriptor then
> overwrites its DMA address and loses the mapping.
> 
> Remove the extra decrement so the error path unmaps every successful
> mapping.
> 
> Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of
> unsigned in *_tx_map()")
> Cc: [email protected]
> Signed-off-by: Xuanqiang Luo <[email protected]>
> ---
>  drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c
> b/drivers/net/ethernet/intel/igbvf/netdev.c
> index c5ae15fcdca75..3d2aba5c3f126 100644
> --- a/drivers/net/ethernet/intel/igbvf/netdev.c
> +++ b/drivers/net/ethernet/intel/igbvf/netdev.c
> @@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct
> igbvf_adapter *adapter,
>  	buffer_info->time_stamp = 0;
>  	buffer_info->length = 0;
>  	buffer_info->mapped_as_page = false;
> -	if (count)
> -		count--;
> 
>  	/* clear timestamp and dma mappings for remaining portion of
> packet */
>  	while (count--) {
> --
> 2.43.0

Reviewed-by: Aleksandr Loktionov <[email protected]>