The b44 driver calls dma_map_single() in the transmit path but fails to check the return value for errors using dma_mapping_error(). If the DMA mapping fails under memory pressure, it can lead to memory corruption. Add the missing check, drop the skb, and return NETDEV_TX_OK to prevent ring corruption. Signed-off-by: Adriano Vero --- drivers/net/ethernet/broadcom/b44.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c index 90df02e00..280ea6dbe 100644 --- a/drivers/net/ethernet/broadcom/b44.c +++ b/drivers/net/ethernet/broadcom/b44.c @@ -964,8 +964,14 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev) } mapping = dma_map_single(bp->sdev->dma_dev, skb->data, len, DMA_TO_DEVICE); - if (dma_mapping_error(bp->sdev->dma_dev, mapping) || mapping + len > DMA_BIT_MASK(30)) { - struct sk_buff *bounce_skb; + + if (dma_mapping_error(bp->sdev->dma_dev, mapping)) { + dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + + if (mapping + len > DMA_BIT_MASK(30)) { + struct sk_buff *bounce_skb; /* Chip can't handle DMA to/from >1GB, use bounce buffer */ if (!dma_mapping_error(bp->sdev->dma_dev, mapping)) -- 2.47.3