Re: [PATCH] wifi: rtw88: pci: preserve the RX ring DMA address on cleanup

[Luka Gejak]

On Fri Oct 9, 2026 at 5:23 AM CEST, Hungyu Lin wrote:
> rtw_pci_init_rx_ring() stores the coherent ring DMA address in dma, but
> reuses it for RX buffer DMA addresses during error cleanup. If
> initialization fails after at least one buffer has been mapped,
> dma_free_coherent() receives the last buffer's DMA address instead of
> the ring's.
>
> Use a separate variable for the buffer DMA addresses so the ring is
> freed with the address returned by dma_alloc_coherent().
>
> Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
> Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
> ---
>  drivers/net/wireless/realtek/rtw88/pci.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
> index 66d2e5f51444..10147375f3b2 100644
> --- a/drivers/net/wireless/realtek/rtw88/pci.c
> +++ b/drivers/net/wireless/realtek/rtw88/pci.c
> @@ -298,11 +298,13 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev,
>  
>  err_out:
>  	for (i = 0; i < allocated; i++) {
> +		dma_addr_t buf_dma;
> +
>  		skb = rx_ring->buf[i];
>  		if (!skb)
>  			continue;
> -		dma = *((dma_addr_t *)skb->cb);
> -		dma_unmap_single(&pdev->dev, dma, buf_sz, DMA_FROM_DEVICE);
> +		buf_dma = *((dma_addr_t *)skb->cb);
> +		dma_unmap_single(&pdev->dev, buf_dma, buf_sz, DMA_FROM_DEVICE);
>  		dev_kfree_skb_any(skb);
>  		rx_ring->buf[i] = NULL;
>  	}

This patch should cc stable so it gets backported. Besides that it
looks good to me. Ping-Ke maybe you can add Cc: stable@xxxxxxxxxxxxxxx
when applying to your tree?

Reviewed-by: Luka Gejak <luka.gejak@xxxxxxxxx>

Best regards,
Luka Gejak