Re: [PATCH net 2/6] net: bcmasp: unmap previous DMA mappings on TX map failure

[Nicolai Buchwitz <nb@tipi-net.de>]

On 23.9.2026 00:16, Florian Fainelli wrote:
> When mapping an skb with fragments for transmission in bcmasp_xmit(),
> if mapping fails on fragment i > 0, the error handler calls
> bcmasp_clean_txcb() for previous iterations j < i. However,
> bcmasp_clean_txcb() only zeroes the control block fields without
> unmapping the DMA buffers, leaking the DMA mappings allocated for the
> head and earlier fragments.
> 
> Call dma_unmap_single() before calling bcmasp_clean_txcb() in the error
> cleanup loop.
> 
> Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet 
> controller")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c 
> b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
> index f2176ef3a127..9ad5a982542f 100644
> --- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
> +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
> @@ -285,6 +285,11 @@ static netdev_tx_t bcmasp_xmit(struct sk_buff 
> *skb, struct net_device *dev)
>  			intf->mib.tx_dma_failed++;
>  			spb_index = intf->tx_spb_index;
>  			for (j = 0; j < i; j++) {
> +				txcb = &intf->tx_cbs[spb_index];
> +				dma_unmap_single(kdev,
> +						 dma_unmap_addr(txcb, dma_addr),
> +						 dma_unmap_len(txcb, dma_len),
> +						 DMA_TO_DEVICE);
>  				bcmasp_clean_txcb(intf, spb_index);
>  				spb_index = incr_ring(spb_index,
>  						      DESC_RING_COUNT);

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks,
Nicolai