RE: [PATCH net] net: xilinx: axienet: Increment Rx skb ring head pointer after BD is successfully allocated in dmaengine flow
From: "Pandey, Radhey Shyam" <radhey.shyam.pandey@amd.com>
Date: 2025-08-06 09:03:21
Also in:
linux-arm-kernel, lkml
[AMD Official Use Only - AMD Internal Distribution Only]
-----Original Message-----
From: Suraj Gupta <redacted>
Sent: Wednesday, August 6, 2025 12:50 AM
To: andrew+netdev@lunn.ch; davem@davemloft.net; edumazet@google.com;
kuba@kernel.org; pabeni@redhat.com; Simek, Michal [off-list ref];
sean.anderson@linux.dev; Pandey, Radhey Shyam
[off-list ref]; horms@kernel.org
Cc: netdev@vger.kernel.org; linux-arm-kernel@lists.infradead.org; linux-
kernel@vger.kernel.org; Katakam, Harini [off-list ref]
Subject: [PATCH net] net: xilinx: axienet: Increment Rx skb ring head pointer after
BD is successfully allocated in dmaengine flow
In DMAengine flow, AXI DMA driver invokes callback before freeing BD in
irq handling path.
In Rx callback (axienet_dma_rx_cb()), axienet driver tries to allocate
new BD after processing skb.
This will be problematic if both AXI-DMA and AXI ethernet have same
BD count as all Rx BDs will be allocated initially and it won't be
able to allocate new one after Rx irq. Incrementing head pointer w/o
checking for BD allocation will result in garbage values in skb BD and
cause the below kernel crash:
Unable to handle kernel paging request at virtual address fffffffffffffffa
<snip>
Internal error: Oops: 0000000096000006 [#1] SMP
pc : axienet_dma_rx_cb+0x78/0x150
lr : axienet_dma_rx_cb+0x78/0x150
Call trace:
axienet_dma_rx_cb+0x78/0x150 (P)
xilinx_dma_do_tasklet+0xdc/0x290
tasklet_action_common+0x12c/0x178
tasklet_action+0x30/0x3c
handle_softirqs+0xf8/0x230
<snip>
Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support")
Signed-off-by: Suraj Gupta <redacted>Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
quoted hunk ↗ jump to hunk
--- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.cb/drivers/net/ethernet/xilinx/xilinx_axienet_main.c index 6011d7eae0c7..acd5be60afec 100644--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c@@ -1457,7 +1457,6 @@ static void axienet_rx_submit_desc(struct net_device*ndev) if (!skbuf_dma) return; - lp->rx_ring_head++; skb = netdev_alloc_skb(ndev, lp->max_frm_size); if (!skb) return;@@ -1482,6 +1481,7 @@ static void axienet_rx_submit_desc(struct net_device*ndev) skbuf_dma->desc = dma_rx_desc; dma_rx_desc->callback_param = lp; dma_rx_desc->callback_result = axienet_dma_rx_cb; + lp->rx_ring_head++; dmaengine_submit(dma_rx_desc); return; -- 2.25.1