-----Original Message----- From: Wei Fang wei.fang@nxp.com Sent: Monday, February 17, 2025 11:39 AM
[...]
Subject: [PATCH net 1/8] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
When the DMA mapping error occurs, it will attempt to free 'count + 1'
Hi Wei, Are you sure?
dma_err occurs before count is incremented, at least that's the design.
First step already contradicts your claim: ``` static int enetc_map_tx_buffs(struct enetc_bdr *tx_ring, struct sk_buff *skb) { [...] int i, count = 0; [...] dma = dma_map_single(tx_ring->dev, skb->data, len, DMA_TO_DEVICE); if (unlikely(dma_mapping_error(tx_ring->dev, dma))) goto dma_err;
===> count is 0 on goto path! [...] count++; ```
Regards, Claudiu