-----Original Message----- From: Wei Fang wei.fang@nxp.com Sent: Tuesday, February 18, 2025 4:03 AM
[,,,]
Subject: RE: [PATCH net 1/8] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
-----Original Message----- From: Wei Fang wei.fang@nxp.com Sent: Monday, February 17, 2025 11:39 AM
[...]
Subject: [PATCH net 1/8] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
When the DMA mapping error occurs, it will attempt to free 'count + 1'
Hi Wei, Are you sure?
dma_err occurs before count is incremented, at least that's the design.
First step already contradicts your claim:
static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb) { [...] int i, count = 0; [...] dma = dma_map_single(tx_ring->dev, skb->data, len,DMA_TO_DEVICE);
if (unlikely(dma_mapping_error(tx_ring->dev, dma))) goto dma_err;
===> count is 0 on goto path! [...] count++;
Hi Claudiu,
I think it's fine in your case, the count is 0, and the tx_swbd is not set, so it's unnecessary to call enetc_free_tx_frame() in the dma_err path.
enetc_free_tx_frame() call on dma_err path is still needed for count 0 because it needs to free the skb.