Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'fix-rx-fatal-errors'
Jiawen Wu says:
====================
Fix Rx fatal errors
There are some fatal errors on the Rx NAPI path, which can cause
the kernel to crash. Fix known issues and potential risks.
The part of the patches has been mentioned before[1].
[1]: https://lore.kernel.org/all/C8A23A11DB646E60+20250630094102.22265-1-jiawenwu@trustnetic.com/
v1: https://lore.kernel.org/20250709064025.19436-1-jiawenwu@trustnetic.com
====================
Link: https://patch.msgid.link/20250714024755.17512-1-jiawenwu@trustnetic.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+10
-19
+3
-4
drivers/net/ethernet/wangxun/libwx/wx_hw.c
+3
-4
drivers/net/ethernet/wangxun/libwx/wx_hw.c
···
1912
1912
struct wx_ring *ring)
1913
1913
{
1914
1914
u16 reg_idx = ring->reg_idx;
1915
-
union wx_rx_desc *rx_desc;
1916
1915
u64 rdba = ring->dma;
1917
1916
u32 rxdctl;
1918
1917
···
1941
1942
memset(ring->rx_buffer_info, 0,
1942
1943
sizeof(struct wx_rx_buffer) * ring->count);
1943
1944
1944
-
/* initialize Rx descriptor 0 */
1945
-
rx_desc = WX_RX_DESC(ring, 0);
1946
-
rx_desc->wb.upper.length = 0;
1945
+
/* reset ntu and ntc to place SW in sync with hardware */
1946
+
ring->next_to_clean = 0;
1947
+
ring->next_to_use = 0;
1947
1948
1948
1949
/* enable receive descriptor ring */
1949
1950
wr32m(wx, WX_PX_RR_CFG(reg_idx),
+7
-13
drivers/net/ethernet/wangxun/libwx/wx_lib.c
+7
-13
drivers/net/ethernet/wangxun/libwx/wx_lib.c
···
174
174
skb_frag_off(frag),
175
175
skb_frag_size(frag),
176
176
DMA_FROM_DEVICE);
177
-
178
-
/* If the page was released, just unmap it. */
179
-
if (unlikely(WX_CB(skb)->page_released))
180
-
page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
181
177
}
182
178
183
179
static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring,
···
223
227
struct sk_buff *skb,
224
228
int rx_buffer_pgcnt)
225
229
{
226
-
if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma)
227
-
/* the page has been released from the ring */
228
-
WX_CB(skb)->page_released = true;
229
-
230
230
/* clear contents of rx_buffer */
231
231
rx_buffer->page = NULL;
232
232
rx_buffer->skb = NULL;
···
307
315
return false;
308
316
dma = page_pool_get_dma_addr(page);
309
317
310
-
bi->page_dma = dma;
318
+
bi->dma = dma;
311
319
bi->page = page;
312
320
bi->page_offset = 0;
313
321
···
344
352
DMA_FROM_DEVICE);
345
353
346
354
rx_desc->read.pkt_addr =
347
-
cpu_to_le64(bi->page_dma + bi->page_offset);
355
+
cpu_to_le64(bi->dma + bi->page_offset);
348
356
349
357
rx_desc++;
350
358
bi++;
···
357
365
358
366
/* clear the status bits for the next_to_use descriptor */
359
367
rx_desc->wb.upper.status_error = 0;
368
+
/* clear the length for the next_to_use descriptor */
369
+
rx_desc->wb.upper.length = 0;
360
370
361
371
cleaned_count--;
362
372
} while (cleaned_count);
···
2417
2423
if (rx_buffer->skb) {
2418
2424
struct sk_buff *skb = rx_buffer->skb;
2419
2425
2420
-
if (WX_CB(skb)->page_released)
2421
-
page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
2422
-
2423
2426
dev_kfree_skb(skb);
2424
2427
}
2425
2428
···
2439
2448
rx_buffer = rx_ring->rx_buffer_info;
2440
2449
}
2441
2450
}
2451
+
2452
+
/* Zero out the descriptor ring */
2453
+
memset(rx_ring->desc, 0, rx_ring->size);
2442
2454
2443
2455
rx_ring->next_to_alloc = 0;
2444
2456
rx_ring->next_to_clean = 0;
-2
drivers/net/ethernet/wangxun/libwx/wx_type.h
-2
drivers/net/ethernet/wangxun/libwx/wx_type.h
···
909
909
struct wx_cb {
910
910
dma_addr_t dma;
911
911
u16 append_cnt; /* number of skb's appended */
912
-
bool page_released;
913
912
bool dma_released;
914
913
};
915
914
···
997
998
struct wx_rx_buffer {
998
999
struct sk_buff *skb;
999
1000
dma_addr_t dma;
1000
-
dma_addr_t page_dma;
1001
1001
struct page *page;
1002
1002
unsigned int page_offset;
1003
1003
};