From: Markus Stockhausen Date: Thu, 14 May 2026 19:30:47 +0000 (+0200) Subject: realtek: eth: fix transmit path unmapping order X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8134e6d18744fa53d035fb65b00b9e486256af6e;p=thirdparty%2Fopenwrt.git realtek: eth: fix transmit path unmapping order packet->dma is overwritten with a new mapping before the previous buffer is unmapped. This causes the kernel to unmap the wrong memory address, leading to memory leaks and potential corruption. Additionally set skb pointer to NULL to avoid a free when the buffer is recycled next time. Reorder unmapping/mapping sequence. Fixes: 41300fd88 ("refactor transmit function") Signed-off-by: Markus Stockhausen Link: https://github.com/openwrt/openwrt/pull/23375 Signed-off-by: Robert Marko --- diff --git a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c index 26e97575cbd..4649285eb3e 100644 --- a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c +++ b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c @@ -960,20 +960,21 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *netdev) return NETDEV_TX_BUSY; } + if (likely(packet->skb)) { + /* cleanup old data of this slot */ + dma_unmap_single(dev, packet->dma, packet->skb->len, DMA_TO_DEVICE); + dev_kfree_skb_any(packet->skb); + } + packet->dma = dma_map_single(dev, skb->data, len, DMA_TO_DEVICE); if (unlikely(dma_mapping_error(dev, packet->dma))) { dev_kfree_skb_any(skb); + packet->skb = NULL; netdev->stats.tx_errors++; return NETDEV_TX_OK; } - if (likely(packet->skb)) { - /* cleanup old data of this slot */ - dma_unmap_single(dev, packet->dma, packet->skb->len, DMA_TO_DEVICE); - dev_kfree_skb_any(packet->skb); - } - if (dest_port >= 0) ctrl->r->create_tx_header(packet, dest_port, 0); // TODO ok to set prio to 0?