openwrt-mirror/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-06-17 14:50:15 +04:00
Code Issues Packages Projects Releases Wiki Activity

realtek: eth: fix transmit path unmapping order

Browse Source 
packet->dma is overwritten with a new mapping before
the previous buffer is unmapped. This causes the kernel
to unmap the wrong memory address, leading to memory
leaks and potential corruption.

Additionally set skb pointer to NULL to avoid a free
when the buffer is recycled next time.

Reorder unmapping/mapping sequence.

Fixes: 41300fd88 ("refactor transmit function")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23375
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
Markus Stockhausen
2026-05-14 21:30:47 +02:00
committed by Robert Marko
parent ae38d72a7a
commit 8134e6d187
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c
+9 -8
View File
@@ -960,20 +960,21 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *netdev)
return NETDEV_TX_BUSY;
}
packet->dma = dma_map_single(dev, skb->data, len, DMA_TO_DEVICE);
if (unlikely(dma_mapping_error(dev, packet->dma))) {
dev_kfree_skb_any(skb);
netdev->stats.tx_errors++;
return NETDEV_TX_OK;
}
if (likely(packet->skb)) {
/* cleanup old data of this slot */
dma_unmap_single(dev, packet->dma, packet->skb->len, DMA_TO_DEVICE);
dev_kfree_skb_any(packet->skb);
}
packet->dma = dma_map_single(dev, skb->data, len, DMA_TO_DEVICE);
if (unlikely(dma_mapping_error(dev, packet->dma))) {
dev_kfree_skb_any(skb);
packet->skb = NULL;
netdev->stats.tx_errors++;
return NETDEV_TX_OK;
}
if (dest_port >= 0)
ctrl->r->create_tx_header(packet, dest_port, 0); // TODO ok to set prio to 0?