From: Nickolay Savchenko Date: Fri, 17 Jul 2026 13:13:05 +0000 (+0300) Subject: ramips: fix frame engine DMA length cleanup X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7c2586ffe77fee4276350bce5c954718d500f22d;p=thirdparty%2Fopenwrt.git ramips: fix frame engine DMA length cleanup fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX mapping must be passed to dma_unmap_page(). After unmapping, however, the code passed the dma_addr0 and dma_addr1 field identifiers to dma_unmap_len_set(). This leaves the actual length fields unchanged. A reused descriptor slot can therefore retain a non-zero length and attempt to unmap an old DMA mapping again. Clear dma_len0 and dma_len1 after the mappings have been released. Signed-off-by: Nickolay Savchenko Link: https://github.com/openwrt/openwrt/pull/24268 Signed-off-by: Jonas Jelonek --- diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c index 7580b2d42bf..a7b421ceb51 100644 --- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c +++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c @@ -344,8 +344,8 @@ static void fe_txd_unmap(struct device *dev, struct fe_tx_buf *tx_buf) dma_unmap_len(tx_buf, dma_len1), DMA_TO_DEVICE); - dma_unmap_len_set(tx_buf, dma_addr0, 0); - dma_unmap_len_set(tx_buf, dma_addr1, 0); + dma_unmap_len_set(tx_buf, dma_len0, 0); + dma_unmap_len_set(tx_buf, dma_len1, 0); if (tx_buf->skb && (tx_buf->skb != (struct sk_buff *)DMA_DUMMY_DESC)) dev_kfree_skb_any(tx_buf->skb); tx_buf->skb = NULL;