Re: [PATCH] net: alteon: Add missing DMA mapping error checks in ace_start_xmit
From: Joe Damato <hidden>
Date: 2026-03-31 23:43:24
Also in:
lkml, stable
On Tue, Mar 31, 2026 at 09:48:41AM +0800, Wang Jun wrote:
The ace_start_xmit function does not check the return value of
dma_map_page (via ace_map_tx_skb) and skb_frag_dma_map when building
transmit descriptors. If mapping fails, an invalid DMA address is
written to the descriptor, which may cause hardware to access
illegal memory, leading to system instability or crashes.
Add proper dma_mapping_error() checks for all mapping calls. When
mapping fails, free the skb, increment the dropped packet counter,
and return NETDEV_TX_OK.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")Is this fixing a bug you've seen in the wild? If not, I'd probably drop the fixes tag and send this to net-next instead.
quoted hunk ↗ jump to hunk
Cc: stable@vger.kernel.org Signed-off-by: Wang Jun <redacted> --- drivers/net/ethernet/alteon/acenic.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)diff --git a/drivers/net/ethernet/alteon/acenic.c b/drivers/net/ethernet/alteon/acenic.c index 455ee8930824..acabede53663 100644 --- a/drivers/net/ethernet/alteon/acenic.c +++ b/drivers/net/ethernet/alteon/acenic.c@@ -2417,6 +2417,11 @@ static netdev_tx_t ace_start_xmit(struct sk_buff *skb, u32 vlan_tag = 0; mapping = ace_map_tx_skb(ap, skb, skb, idx); + if (dma_mapping_error(&ap->pdev->dev, mapping)) { + dev_kfree_skb(skb); + dev->stats.tx_dropped++; + return NETDEV_TX_OK; + } flagsize = (skb->len << 16) | (BD_FLG_END); if (skb->ip_summed == CHECKSUM_PARTIAL) flagsize |= BD_FLG_TCP_UDP_SUM;@@ -2438,6 +2443,11 @@ static netdev_tx_t ace_start_xmit(struct sk_buff *skb, int i; mapping = ace_map_tx_skb(ap, skb, NULL, idx); + if (dma_mapping_error(&ap->pdev->dev, mapping)) { + dev_kfree_skb(skb); + dev->stats.tx_dropped++; + return NETDEV_TX_OK; + }
I am not sure about this. The function ace_map_tx_skb seems to modify a tx_ring_info entry, possibly writing invalid state to it if the dma_map_page fails? Maybe a better fix would be to refactor ace_map_tx_skb and do the dma_mapping_error check there and change the return type of the function and the code flow? Then you wouldn't need to duplicate the error path handling code.