[PATCH] wifi: rtw88: pci: preserve the RX ring DMA address on cleanup

[PATCH] wifi: rtw88: pci: preserve the RX ring DMA address on cleanup

[Hungyu Lin]

rtw_pci_init_rx_ring() stores the coherent ring DMA address in dma, but
reuses it for RX buffer DMA addresses during error cleanup. If
initialization fails after at least one buffer has been mapped,
dma_free_coherent() receives the last buffer's DMA address instead of
the ring's.

Use a separate variable for the buffer DMA addresses so the ring is
freed with the address returned by dma_alloc_coherent().

Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/net/wireless/realtek/rtw88/pci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index 66d2e5f51444..10147375f3b2 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -298,11 +298,13 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev,
 
 err_out:
 	for (i = 0; i < allocated; i++) {
+		dma_addr_t buf_dma;
+
 		skb = rx_ring->buf[i];
 		if (!skb)
 			continue;
-		dma = *((dma_addr_t *)skb->cb);
-		dma_unmap_single(&pdev->dev, dma, buf_sz, DMA_FROM_DEVICE);
+		buf_dma = *((dma_addr_t *)skb->cb);
+		dma_unmap_single(&pdev->dev, buf_dma, buf_sz, DMA_FROM_DEVICE);
 		dev_kfree_skb_any(skb);
 		rx_ring->buf[i] = NULL;
 	}

Re: [PATCH] wifi: rtw88: pci: preserve the RX ring DMA address on cleanup

[Luka Gejak]

On Fri Oct 9, 2026 at 5:23 AM CEST, Hungyu Lin wrote:
> rtw_pci_init_rx_ring() stores the coherent ring DMA address in dma, but
> reuses it for RX buffer DMA addresses during error cleanup. If
> initialization fails after at least one buffer has been mapped,
> dma_free_coherent() receives the last buffer's DMA address instead of
> the ring's.
>
> Use a separate variable for the buffer DMA addresses so the ring is
> freed with the address returned by dma_alloc_coherent().
>
> Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  drivers/net/wireless/realtek/rtw88/pci.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
> index 66d2e5f51444..10147375f3b2 100644
> --- a/drivers/net/wireless/realtek/rtw88/pci.c
> +++ b/drivers/net/wireless/realtek/rtw88/pci.c
> @@ -298,11 +298,13 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev,
>  
>  err_out:
>  	for (i = 0; i < allocated; i++) {
> +		dma_addr_t buf_dma;
> +
>  		skb = rx_ring->buf[i];
>  		if (!skb)
>  			continue;
> -		dma = *((dma_addr_t *)skb->cb);
> -		dma_unmap_single(&pdev->dev, dma, buf_sz, DMA_FROM_DEVICE);
> +		buf_dma = *((dma_addr_t *)skb->cb);
> +		dma_unmap_single(&pdev->dev, buf_dma, buf_sz, DMA_FROM_DEVICE);
>  		dev_kfree_skb_any(skb);
>  		rx_ring->buf[i] = NULL;
>  	}

This patch should cc stable so it gets backported. Besides that it
looks good to me. Ping-Ke maybe you can add Cc: stable@vger.kernel.org
when applying to your tree?

Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

Best regards,
Luka Gejak