[PATCH net-next] net: ethernet: mtk_wed: Fix dma_unmap_single() size

[Lorenzo Bianconi]

> In mtk_wed_wo_queue_refill(), the entry->buf is DMA mapped with length
> q->buf_size which saved in entry->len. However, in mtk_wed_wo_dequeue(),
> the same buffer is DMA unmapped with length buf_len which is set to
> SKB_WITH_OVERHEAD(q->buf_size).
> 
> Change the size to q->buf_size.
> 
> This was discovered with static analysis and was only compile-tested.
> 
> Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
> Signed-off-by: Thomas Fourier <fourier.thomas at gmail.com>
> ---
>  drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.c b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
> index 7063c78bd35f..4f720ec53e20 100644
> --- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
> +++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
> @@ -99,7 +99,6 @@ static void *
>  mtk_wed_wo_dequeue(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q, u32 *len,
>  		   bool flush)
>  {
> -	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
>  	int index = (q->tail + 1) % q->n_desc;
>  	struct mtk_wed_wo_queue_entry *entry;
>  	struct mtk_wed_wo_queue_desc *desc;
> @@ -123,7 +122,7 @@ mtk_wed_wo_dequeue(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q, u32 *len,
>  		*len = FIELD_GET(MTK_WED_WO_CTL_SD_LEN0,
>  				 le32_to_cpu(READ_ONCE(desc->ctrl)));
>  	if (buf)
> -		dma_unmap_single(wo->hw->dev, entry->addr, buf_len,
> +		dma_unmap_single(wo->hw->dev, entry->addr, q->buf_size,

I guess you can use entry->len here to align with the tx side. Anyway:

Acked-by: Lorenzo Bianconi <lorenzo at kernel.org>

>  				 DMA_FROM_DEVICE);
>  	entry->buf = NULL;
>  
> -- 
> 2.53.0
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-mediatek/attachments/20261015/2683ea53/attachment-0001.sig>