Re: [PATCH v4 3/4] net: xilinx: axienet: Derive RX frame length from residue in dmaengine path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The dmaengine teardown path leaks all in-flight SKBs and DMA mappings when the interface is stopped.
--

--- Patch [3]: [PATCH v4 3/4] net: xilinx: axienet: Derive RX frame length from residue in dmaengine path ---
commit 99e70bd1e2ac117d993d11234fd0dea54d95440b
Author: Srinivas Neeli <srinivas.neeli@amd.com>
Subject: net: xilinx: axienet: Derive RX frame length from residue in dmaengine path

This commit updates the dmaengine RX path to derive the received frame
length from the dmaengine residue rather than descriptor APP metadata.
This removes the dependency on the optional AXI4-Stream status/control
interface.

> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index fcf517069d161..67d1b8e91d683 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -53,7 +53,6 @@
[ ... ]

While reviewing this code, I noticed a pre-existing issue in axienet_stop():

drivers/net/ethernet/xilinx/xilinx_axienet_main.c:axienet_stop() {
    ...
    for (i = 0; i < TX_BD_NUM_MAX; i++)
        kfree(lp->tx_skb_ring[i]);
    kfree(lp->tx_skb_ring);

    for (i = 0; i < RX_BUF_NUM_DEFAULT; i++)
        kfree(lp->rx_skb_ring[i]);
    kfree(lp->rx_skb_ring);
    ...
}

[Severity: High]
This is a pre-existing issue, but does this dmaengine teardown path leak
all in-flight SKBs and DMA mappings when the interface is stopped?

When using dmaengine, the DMA channels are terminated which aborts
transfers without calling completion callbacks. The code then iterates
through the descriptor arrays and frees each skbuf_dma_descriptor
container.

It appears to fail to unmap the dma_address and free the actual skb stored
within the descriptor.

Could toggling the interface down and up repeatedly leak the entire RX ring
and any pending TX SKBs along with their DMA mappings, potentially
exhausting system memory and IOMMU space over time?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713072146.45269-1-srinivas.neeli@amd.com?part=3