From 7c2586ffe77fee4276350bce5c954718d500f22d Mon Sep 17 00:00:00 2001 From: Nickolay Savchenko Date: Fri, 17 Jul 2026 16:13:05 +0300 Subject: [PATCH] ramips: fix frame engine DMA length cleanup fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX mapping must be passed to dma_unmap_page(). After unmapping, however, the code passed the dma_addr0 and dma_addr1 field identifiers to dma_unmap_len_set(). This leaves the actual length fields unchanged. A reused descriptor slot can therefore retain a non-zero length and attempt to unmap an old DMA mapping again. Clear dma_len0 and dma_len1 after the mappings have been released. Signed-off-by: Nickolay Savchenko Link: https://github.com/openwrt/openwrt/pull/24268 Signed-off-by: Jonas Jelonek --- .../ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c index 7580b2d42b..a7b421ceb5 100644 --- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c +++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c @@ -344,8 +344,8 @@ static void fe_txd_unmap(struct device *dev, struct fe_tx_buf *tx_buf) dma_unmap_len(tx_buf, dma_len1), DMA_TO_DEVICE); - dma_unmap_len_set(tx_buf, dma_addr0, 0); - dma_unmap_len_set(tx_buf, dma_addr1, 0); + dma_unmap_len_set(tx_buf, dma_len0, 0); + dma_unmap_len_set(tx_buf, dma_len1, 0); if (tx_buf->skb && (tx_buf->skb != (struct sk_buff *)DMA_DUMMY_DESC)) dev_kfree_skb_any(tx_buf->skb); tx_buf->skb = NULL;