diff options
Diffstat (limited to 'target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch')
| -rw-r--r-- | target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch | 65 |
1 files changed, 65 insertions, 0 deletions
diff --git a/target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch b/target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch new file mode 100644 index 0000000000..29cf3742f4 --- /dev/null +++ b/target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch @@ -0,0 +1,65 @@ +From ef3556ee16c68735ec69bd08df41d1cd83b14ad3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> +Date: Thu, 27 Oct 2022 13:24:30 +0200 +Subject: [PATCH] net: broadcom: bcm4908_enet: update TX stats after actual + transmission +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Queueing packets doesn't guarantee their transmission. Update TX stats +after hardware confirms consuming submitted data. + +This also fixes a possible race and NULL dereference. +bcm4908_enet_start_xmit() could try to access skb after freeing it in +the bcm4908_enet_poll_tx(). + +Reported-by: Florian Fainelli <f.fainelli@gmail.com> +Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver") +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> +Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +--- + drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c +@@ -560,8 +560,6 @@ static int bcm4908_enet_start_xmit(struc + + if (++ring->write_idx == ring->length - 1) + ring->write_idx = 0; +- enet->netdev->stats.tx_bytes += skb->len; +- enet->netdev->stats.tx_packets++; + + return NETDEV_TX_OK; + } +@@ -634,6 +632,7 @@ static int bcm4908_enet_poll_tx(struct n + struct bcm4908_enet_dma_ring_bd *buf_desc; + struct bcm4908_enet_dma_ring_slot *slot; + struct device *dev = enet->dev; ++ unsigned int bytes = 0; + int handled = 0; + + while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) { +@@ -644,12 +643,17 @@ static int bcm4908_enet_poll_tx(struct n + + dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE); + dev_kfree_skb(slot->skb); +- if (++tx_ring->read_idx == tx_ring->length) +- tx_ring->read_idx = 0; + + handled++; ++ bytes += slot->len; ++ ++ if (++tx_ring->read_idx == tx_ring->length) ++ tx_ring->read_idx = 0; + } + ++ enet->netdev->stats.tx_packets += handled; ++ enet->netdev->stats.tx_bytes += bytes; ++ + if (handled < weight) { + napi_complete_done(napi, handled); + bcm4908_enet_dma_ring_intrs_on(enet, tx_ring); |