net: sgi: ioc3-eth: fix split TX DMA mapping lengths

When a linear skb crosses a 16 KiB boundary, ioc3_start_xmit()
splits it into two buffers of lengths s1 and s2.  The descriptor
advertises those lengths through B1CNT and B2CNT.

The first buffer is mapped with s1, but the second buffer is also
mapped with s1 even though the device is told to fetch s2 bytes from
it.  When the lengths differ, the DMA mapping does not cover the same
region as the second descriptor buffer, which can result in incorrect
cache maintenance or a DMA fault on implementations that enforce the
mapped range.

There is a separate mismatch in the error path.  If mapping the second
buffer fails, only d1 needs to be unmapped.  d1 was mapped for s1 bytes,
but the driver unmaps it using the full packet length.  Streaming DMA
mappings must be unmapped with the same size used for the corresponding
map operation.

Map the second buffer with s2 and unmap the first buffer with s1 when
the second mapping fails.

Cc: <stable+noautosel@kernel.org> # untested fix for ancient HW
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://patch.msgid.link/4E1486BC4536407E+20260629080623.908426-1-raoxu@uniontech.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions