[Intel-wired-lan] [PATCH iwl-net v1] igbvf: fix DMA mapping leak on Tx error

[Tony Nguyen]

On 7/21/2026 2:23 AM, xuanqiang.luo at linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang at kylinos.cn>
> 
> When mapping a fragmented skb fails, count already matches the number of
> successful mappings that must be undone. Decrementing it before the cleanup
> loop leaves one mapping active. Reusing the descriptor then overwrites its
> DMA address and loses the mapping.
> 
> Remove the extra decrement so the error path unmaps every successful
> mapping.

Thanks for the patch Xuanqiang, but we had one submitted for this already.

https://lore.kernel.org/intel-wired-lan/20260417033452.640551-1-tactii@gmail.com/

Thanks,
Tony

> Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
> Cc: stable at vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang at kylinos.cn>
> ---
>   drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
>   1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
> index c5ae15fcdca75..3d2aba5c3f126 100644
> --- a/drivers/net/ethernet/intel/igbvf/netdev.c
> +++ b/drivers/net/ethernet/intel/igbvf/netdev.c
> @@ -2190,8 +2190,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
>   	buffer_info->time_stamp = 0;
>   	buffer_info->length = 0;
>   	buffer_info->mapped_as_page = false;
> -	if (count)
> -		count--;
>   
>   	/* clear timestamp and dma mappings for remaining portion of packet */
>   	while (count--) {