ramips: fix frame engine DMA length cleanup

fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX
mapping must be passed to dma_unmap_page().  After unmapping, however,
the code passed the dma_addr0 and dma_addr1 field identifiers to
dma_unmap_len_set().

This leaves the actual length fields unchanged.  A reused descriptor
slot can therefore retain a non-zero length and attempt to unmap an old
DMA mapping again.

Clear dma_len0 and dma_len1 after the mappings have been released.

Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
index 7580b2d42bf74f8dd2a0953cf36ab7b3b13f5881..a7b421ceb5123d648d3efa430e38bd6f04eed44e 100644 (file)
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
@@ -344,8 +344,8 @@ static void fe_txd_unmap(struct device *dev, struct fe_tx_buf *tx_buf)
                               dma_unmap_len(tx_buf, dma_len1),
                               DMA_TO_DEVICE);
 
-       dma_unmap_len_set(tx_buf, dma_addr0, 0);
-       dma_unmap_len_set(tx_buf, dma_addr1, 0);
+       dma_unmap_len_set(tx_buf, dma_len0, 0);
+       dma_unmap_len_set(tx_buf, dma_len1, 0);
        if (tx_buf->skb && (tx_buf->skb != (struct sk_buff *)DMA_DUMMY_DESC))
                dev_kfree_skb_any(tx_buf->skb);
        tx_buf->skb = NULL;