mirror of
https://github.com/torvalds/linux.git
synced 2026-10-17 06:20:02 +02:00
cd066559a0
When a linear skb crosses a 16 KiB boundary, ioc3_start_xmit() splits it into two buffers of lengths s1 and s2. The descriptor advertises those lengths through B1CNT and B2CNT. The first buffer is mapped with s1, but the second buffer is also mapped with s1 even though the device is told to fetch s2 bytes from it. When the lengths differ, the DMA mapping does not cover the same region as the second descriptor buffer, which can result in incorrect cache maintenance or a DMA fault on implementations that enforce the mapped range. There is a separate mismatch in the error path. If mapping the second buffer fails, only d1 needs to be unmapped. d1 was mapped for s1 bytes, but the driver unmaps it using the full packet length. Streaming DMA mappings must be unmapped with the same size used for the corresponding map operation. Map the second buffer with s2 and unmap the first buffer with s1 when the second mapping fails. Cc: <stable+noautosel@kernel.org> # untested fix for ancient HW Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Link: https://patch.msgid.link/4E1486BC4536407E+20260629080623.908426-1-raoxu@uniontech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|---|---|---|
| .. | ||
| ioc3-eth.c | ||
| Kconfig | ||
| Makefile | ||
| meth.c | ||
| meth.h | ||