RE: [PATCH] wifi: rtw88: pci: preserve the RX ring DMA address on cleanup

[Ping-Ke Shih]

Luka Gejak <luka.gejak@xxxxxxxxx> wrote:
> On Fri Oct 9, 2026 at 5:23 AM CEST, Hungyu Lin wrote:
> > rtw_pci_init_rx_ring() stores the coherent ring DMA address in dma, but
> > reuses it for RX buffer DMA addresses during error cleanup. If
> > initialization fails after at least one buffer has been mapped,
> > dma_free_coherent() receives the last buffer's DMA address instead of
> > the ring's.
> >
> > Use a separate variable for the buffer DMA addresses so the ring is
> > freed with the address returned by dma_alloc_coherent().
> >
> > Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")

Cc: stable@xxxxxxxxxxxxxxx

> > Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>

Acked-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>

> > ---
> >  drivers/net/wireless/realtek/rtw88/pci.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
> > index 66d2e5f51444..10147375f3b2 100644
> > --- a/drivers/net/wireless/realtek/rtw88/pci.c
> > +++ b/drivers/net/wireless/realtek/rtw88/pci.c
> > @@ -298,11 +298,13 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev,
> >
> >  err_out:
> >       for (i = 0; i < allocated; i++) {
> > +             dma_addr_t buf_dma;
> > +
> >               skb = rx_ring->buf[i];
> >               if (!skb)
> >                       continue;
> > -             dma = *((dma_addr_t *)skb->cb);
> > -             dma_unmap_single(&pdev->dev, dma, buf_sz, DMA_FROM_DEVICE);
> > +             buf_dma = *((dma_addr_t *)skb->cb);
> > +             dma_unmap_single(&pdev->dev, buf_dma, buf_sz, DMA_FROM_DEVICE);
> >               dev_kfree_skb_any(skb);
> >               rx_ring->buf[i] = NULL;
> >       }
> 
> This patch should cc stable so it gets backported. Besides that it
> looks good to me. Ping-Ke maybe you can add Cc: stable@xxxxxxxxxxxxxxx
> when applying to your tree?

Sure.

Ping-Ke