realtek: eth: fix transmit path unmapping order

packet->dma is overwritten with a new mapping before
the previous buffer is unmapped. This causes the kernel
to unmap the wrong memory address, leading to memory
leaks and potential corruption.

Additionally set skb pointer to NULL to avoid a free
when the buffer is recycled next time.

Reorder unmapping/mapping sequence.

Fixes: 41300fd88 ("refactor transmit function")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23375
Signed-off-by: Robert Marko <robimarko@gmail.com>

diff --git a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c
index 26e97575cbd19b5570a4ccf7f28ac7ce2a3c08a0..4649285eb3ed2fb9916fb4439820b4741c7790ef 100644 (file)
--- a/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c
+++ b/target/linux/realtek/files-6.18/drivers/net/ethernet/rtl838x_eth.c
@@ -960,20 +960,21 @@ static int rteth_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                return NETDEV_TX_BUSY;
        }
 
+       if (likely(packet->skb)) {
+               /* cleanup old data of this slot */
+               dma_unmap_single(dev, packet->dma, packet->skb->len, DMA_TO_DEVICE);
+               dev_kfree_skb_any(packet->skb);
+       }
+
        packet->dma = dma_map_single(dev, skb->data, len, DMA_TO_DEVICE);
        if (unlikely(dma_mapping_error(dev, packet->dma))) {
                dev_kfree_skb_any(skb);
+               packet->skb = NULL;
                netdev->stats.tx_errors++;
 
                return NETDEV_TX_OK;
        }
 
-       if (likely(packet->skb)) {
-               /* cleanup old data of this slot */
-               dma_unmap_single(dev, packet->dma, packet->skb->len, DMA_TO_DEVICE);
-               dev_kfree_skb_any(packet->skb);
-       }
-
        if (dest_port >= 0)
                ctrl->r->create_tx_header(packet, dest_port, 0); // TODO ok to set prio to 0?