out_unmap: pr_err("%s: IOMMU mapping error in map_sg (io-pages: %d)\n", dev_name(dev), npages); for_each_sg(sglist, s, nelems, i) { int j, pages = iommu_num_pages(sg_phys(s), s->length, PAGE_SIZE); for (j = 0; j < pages; ++j) { unsigned long bus_addr; bus_addr = address + s->dma_address + (j << PAGE_SHIFT); iommu_unmap_page(domain, bus_addr, PAGE_SIZE); if (--mapped_pages) goto out_free_iova; Is this condition correct? My thought is this was meant to break out of the loop early if all the mapped pages have been unmapped. So if (--mapped == 0) instead? } }