From febe1f8cbccc3434790bfc4d94d40c9dbd803065 Mon Sep 17 00:00:00 2001 From: Kang Yang Date: Wed, 16 Sep 2026 14:03:25 +0800 Subject: [PATCH] wifi: ath12k: avoid double DMA unmap of held monitor RX buffers ath12k_dp_cc_cleanup() assumes that every rx_desc_info entry with a non-NULL skb still has an active DMA mapping and therefore always calls dma_unmap_single() before freeing the skb. This assumption is not true for the monitor RX path. ath12k_wifi7_dp_rx_mon_mpdu_pop() may DMA-unmap a buffer and mark rxcb->unmapped before returning early to hold the MSDU for later reprocessing. In that state desc_info->skb remains populated, so module removal can trigger a second dma_unmap_single() from ath12k_dp_cc_cleanup(). IOMMU reports the issue as: dma_unmap_phys() dma_unmap_page_attrs() ath12k_dp_cc_cleanup() ath12k_dp_cmn_device_deinit() ath12k_core_stop() Skip dma_unmap_single() when rxcb->unmapped is already set and free the skb directly. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Fixes: 72bfbf19b7da ("wifi: ath12k: add support to reap and process mon dest ring") Signed-off-by: Kang Yang Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260916060325.854-7-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath12k/dp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c index cce5386c5bd5..83f9edfabf69 100644 --- a/drivers/net/wireless/ath/ath12k/dp.c +++ b/drivers/net/wireless/ath/ath12k/dp.c @@ -1002,10 +1002,11 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab) if (!skb) continue; - dma_unmap_single(ab->dev, - ATH12K_SKB_RXCB(skb)->paddr, - skb->len + skb_tailroom(skb), - DMA_FROM_DEVICE); + if (!ATH12K_SKB_RXCB(skb)->unmapped) + dma_unmap_single(ab->dev, + ATH12K_SKB_RXCB(skb)->paddr, + skb->len + skb_tailroom(skb), + DMA_FROM_DEVICE); dev_kfree_skb_any(skb); }