From 8134e6d18744fa53d035fb65b00b9e486256af6e Mon Sep 17 00:00:00 2001 From: Markus Stockhausen Date: Thu, 14 May 2026 21:30:47 +0200 Subject: [PATCH] realtek: eth: fix transmit path unmapping order packet->dma is overwritten with a new mapping before the previous buffer is unmapped. This causes the kernel to unmap the wrong memory address, leading to memory leaks and potential corruption. Additionally set skb pointer to NULL to avoid a free when the buffer is recycled next time. Reorder unmapping/mapping sequence. Fixes: 41300fd88 ("refactor transmit function") Signed-off-by: Markus Stockhausen Link: https://github.com/openwrt/openwrt/pull/23375 Signed-off-by: Robert Marko --- .../drivers/net/ethernet/rtl838x_eth.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c index 26e97575cbd..4649285eb3e 100644 --- a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c +++ b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c @@ -960,20 +960,21 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *netdev) return NETDEV_TX_BUSY; } - packet->dma = dma_map_single(dev, skb->data, len, DMA_TO_DEVICE); - if (unlikely(dma_mapping_error(dev, packet->dma))) { - dev_kfree_skb_any(skb); - netdev->stats.tx_errors++; - - return NETDEV_TX_OK; - } - if (likely(packet->skb)) { /* cleanup old data of this slot */ dma_unmap_single(dev, packet->dma, packet->skb->len, DMA_TO_DEVICE); dev_kfree_skb_any(packet->skb); } + packet->dma = dma_map_single(dev, skb->data, len, DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(dev, packet->dma))) { + dev_kfree_skb_any(skb); + packet->skb = NULL; + netdev->stats.tx_errors++; + + return NETDEV_TX_OK; + } + if (dest_port >= 0) ctrl->r->create_tx_header(packet, dest_port, 0); // TODO ok to set prio to 0?