unmap_partial_tx_skb() walks the TX ring entries between first_entry and entry to release the DMA mappings of the fragments that were mapped successfully before a mapping error, but it never advances first_entry inside the loop. Whenever the failed fragment is not the first one, entry is ahead of first_entry and the loop condition first_entry != entry never becomes false, so the function spins forever. The function is called from happy_meal_start_xmit() with hp->happy_lock held and interrupts disabled, so the infinite loop leads to a hard lockup. Now that the loop lockup is fixed, a secondary bug becomes reachable: the function unmaps the pages but leaves the descriptors in the ring with the TXFLAG_OWN bit still set. When the driver subsequently processes a new linear packet, the hardware MAC will advance into these stale descriptors, causing IOMMU faults, TX ring desynchronization. Fix both issues by advancing the entry pointer using NEXT_TX() at the end of the loop, and clearing each descriptor via hme_write_txd() immediately after performing the DMA unmap. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ec1f1276022e ("sunhme: Add DMA mapping error checks.") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev --- Changes since v1: - Also clear the stale TX descriptors (hme_write_txd(hp, this, 0,0)) after unmapping them. v1: https://lore.kernel.org/all/20261013103228.37430-1-arefev@swemel.ru/ --- Compile tested only drivers/net/ethernet/sun/sunhme.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c index a70f704eb9f3..dace94841a6f 100644 --- a/drivers/net/ethernet/sun/sunhme.c +++ b/drivers/net/ethernet/sun/sunhme.c @@ -1965,6 +1965,8 @@ static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping, len = hme_read_desc32(hp, &this->tx_flags); len &= TXFLAG_SIZE; dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE); + hme_write_txd(hp, this, 0, 0); + first_entry = NEXT_TX(first_entry); } } -- 2.43.0