On Sun Sep 20, 2026 at 3:19 AM +08, Muhammad Bilal wrote: > emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for > every slot beyond old_head as soon as that slot's memset()'d local > copy is committed with "*tx_desc_addr = tx_desc", i.e. before the > buffers for that slot have necessarily all been mapped successfully. > If emac_tx_map_frag() then fails on a later fragment, the err_free_skb > path calls emac_free_tx_buf() to unmap and drop the skb, but leaves > the already-written descriptor memory untouched, and tx_ring->head is > never advanced past old_head (the "tx_ring->head = head" store is > skipped by the goto). > > So a slot between old_head and the rolled-back head can be left with > TX_DESC_0_OWN set and buffer_addr_{1,2} pointing at DMA mappings that > emac_free_tx_buf() just tore down, while software considers that slot > free again. The next successful emac_tx_mem_map() call only rebuilds > old_head itself; if the DMA engine auto-advances into the following > descriptor once it finishes old_head's packet, it will fetch that > stale, already-unmapped address. > > emac_tx_clean_desc() already treats emac_free_tx_buf() and clearing > the descriptor as a pair when reclaiming completed descriptors; do > the same in the mapping failure path. > > Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") > Signed-off-by: Muhammad Bilal Reviewed-by: Troy Mitchell -- Troy Mitchell