Muhammad Bilal 2d14720beb net: spacemit: clear TX descriptor on fragment mapping failure ... emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for every slot beyond old_head as soon as that slot's memset()'d local copy is committed with "*tx_desc_addr = tx_desc", i.e. before the buffers for that slot have necessarily all been mapped successfully. If emac_tx_map_frag() then fails on a later fragment, the err_free_skb path calls emac_free_tx_buf() to unmap and drop the skb, but leaves the already-written descriptor memory untouched, and tx_ring->head is never advanced past old_head (the "tx_ring->head = head" store is skipped by the goto). So a slot between old_head and the rolled-back head can be left with TX_DESC_0_OWN set and buffer_addr_{1,2} pointing at DMA mappings that emac_free_tx_buf() just tore down, while software considers that slot free again. The next successful emac_tx_mem_map() call only rebuilds old_head itself; if the DMA engine auto-advances into the following descriptor once it finishes old_head's packet, it will fetch that stale, already-unmapped address. emac_tx_clean_desc() already treats emac_free_tx_buf() and clearing the descriptor as a pair when reclaiming completed descriptors; do the same in the mapping failure path. Fixes: bfec6d7f20 ("net: spacemit: Add K1 Ethernet MAC") Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Reviewed-by: Vivian Wang <wangruikang@iscas.ac.cn> Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com> Link: https://patch.msgid.link/20260919191937.271202-1-meatuni001@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2026-09-22 13:02:35 +02:00
..
k1_emac.c	net: spacemit: clear TX descriptor on fragment mapping failure	2026-09-22 13:02:35 +02:00
k1_emac.h	net: spacemit: Avoid -Wflex-array-member-not-at-end warnings	2025-10-22 19:20:29 -07:00
Kconfig
Makefile