tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: stmmac: fix oops when split header is enabled

For GMAC4, when split header is enabled, in some rare cases, the
hardware does not fill buf2 of the first descriptor with payload.
Thus we cannot assume buf2 is always fully filled if it is not
the last descriptor. Otherwise, the length of buf2 of the second
descriptor will be calculated wrong and cause an oops:

Unable to handle kernel paging request at virtual address ffff00019246bfc0
...
x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000
Call trace:
dcache_inval_poc+0x28/0x58 (P)
dma_direct_sync_single_for_cpu+0x38/0x6c
__dma_sync_single_for_cpu+0x34/0x6c
stmmac_napi_poll_rx+0x8f0/0xb60
__napi_poll.constprop.0+0x30/0x144
net_rx_action+0x160/0x274
handle_softirqs+0x1b8/0x1fc
...

To fix this, the PL bit-field in RDES3 register is used for all
descriptors, whether it is the last descriptor or not.

Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jie Zhang <jie.zhang@analog.com>
Link: https://patch.msgid.link/20260209225037.589130-1-jie.zhang@analog.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Jie Zhang and committed by
Jakub Kicinski babab1b4 d03e0944

+17 -3
+17 -3
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
··· 5040 5040 if (!priv->sph_active) 5041 5041 return 0; 5042 5042 5043 - /* Not last descriptor */ 5044 - if (status & rx_not_ls) 5043 + /* For GMAC4, when split header is enabled, in some rare cases, the 5044 + * hardware does not fill buf2 of the first descriptor with payload. 5045 + * Thus we cannot assume buf2 is always fully filled if it is not 5046 + * the last descriptor. Otherwise, the length of buf2 of the second 5047 + * descriptor will be calculated wrong and cause an oops. 5048 + * 5049 + * If this is the last descriptor, 'plen' is the length of the 5050 + * received packet that was transferred to system memory. 5051 + * Otherwise, it is the accumulated number of bytes that have been 5052 + * transferred for the current packet. 5053 + * 5054 + * Thus 'plen - len' always gives the correct length of buf2. 5055 + */ 5056 + 5057 + /* Not GMAC4 and not last descriptor */ 5058 + if (priv->plat->core_type != DWMAC_CORE_GMAC4 && (status & rx_not_ls)) 5045 5059 return priv->dma_conf.dma_buf_sz; 5046 5060 5061 + /* GMAC4 or last descriptor */ 5047 5062 plen = stmmac_get_rx_frame_len(priv, p, coe); 5048 5063 5049 - /* Last descriptor */ 5050 5064 return plen - len; 5051 5065 } 5052 5066