From cd066559a07371e0b97b6155ba4eeaafeb233009 Mon Sep 17 00:00:00 2001 From: Xu Rao Date: Mon, 29 Jun 2026 16:06:23 +0800 Subject: [PATCH] net: sgi: ioc3-eth: fix split TX DMA mapping lengths When a linear skb crosses a 16 KiB boundary, ioc3_start_xmit() splits it into two buffers of lengths s1 and s2. The descriptor advertises those lengths through B1CNT and B2CNT. The first buffer is mapped with s1, but the second buffer is also mapped with s1 even though the device is told to fetch s2 bytes from it. When the lengths differ, the DMA mapping does not cover the same region as the second descriptor buffer, which can result in incorrect cache maintenance or a DMA fault on implementations that enforce the mapped range. There is a separate mismatch in the error path. If mapping the second buffer fails, only d1 needs to be unmapped. d1 was mapped for s1 bytes, but the driver unmaps it using the full packet length. Streaming DMA mappings must be unmapped with the same size used for the corresponding map operation. Map the second buffer with s2 and unmap the first buffer with s1 when the second mapping fails. Cc: # untested fix for ancient HW Signed-off-by: Xu Rao Reviewed-by: Thomas Bogendoerfer Link: https://patch.msgid.link/4E1486BC4536407E+20260629080623.908426-1-raoxu@uniontech.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/sgi/ioc3-eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c index b35f692b1a0e..009f37105eaf 100644 --- a/drivers/net/ethernet/sgi/ioc3-eth.c +++ b/drivers/net/ethernet/sgi/ioc3-eth.c @@ -1062,9 +1062,9 @@ static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev) d1 = dma_map_single(ip->dma_dev, skb->data, s1, DMA_TO_DEVICE); if (dma_mapping_error(ip->dma_dev, d1)) goto drop_packet; - d2 = dma_map_single(ip->dma_dev, (void *)b2, s1, DMA_TO_DEVICE); + d2 = dma_map_single(ip->dma_dev, (void *)b2, s2, DMA_TO_DEVICE); if (dma_mapping_error(ip->dma_dev, d2)) { - dma_unmap_single(ip->dma_dev, d1, len, DMA_TO_DEVICE); + dma_unmap_single(ip->dma_dev, d1, s1, DMA_TO_DEVICE); goto drop_packet; } desc->p1 = cpu_to_be64(ioc3_map(d1, PCI64_ATTR_PREF));