[PATCH] wifi: rtw88: pci: preserve the RX ring DMA address on cleanup

[Hungyu Lin]

rtw_pci_init_rx_ring() stores the coherent ring DMA address in dma, but
reuses it for RX buffer DMA addresses during error cleanup. If
initialization fails after at least one buffer has been mapped,
dma_free_coherent() receives the last buffer's DMA address instead of
the ring's.

Use a separate variable for the buffer DMA addresses so the ring is
freed with the address returned by dma_alloc_coherent().

Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
 drivers/net/wireless/realtek/rtw88/pci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index 66d2e5f51444..10147375f3b2 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -298,11 +298,13 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev,
 
 err_out:
 	for (i = 0; i < allocated; i++) {
+		dma_addr_t buf_dma;
+
 		skb = rx_ring->buf[i];
 		if (!skb)
 			continue;
-		dma = *((dma_addr_t *)skb->cb);
-		dma_unmap_single(&pdev->dev, dma, buf_sz, DMA_FROM_DEVICE);
+		buf_dma = *((dma_addr_t *)skb->cb);
+		dma_unmap_single(&pdev->dev, buf_dma, buf_sz, DMA_FROM_DEVICE);
 		dev_kfree_skb_any(skb);
 		rx_ring->buf[i] = NULL;
 	}