All of lore.kernel.org
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] net: macb: drop in-flight Tx SKBs on close" failed to apply to 5.15-stable tree
@ 2026-07-21  9:14 gregkh
  2026-07-29 16:24 ` [PATCH 5.15.y 1/6] net: macb: simplify/cleanup NAPI reschedule checking Sasha Levin
  0 siblings, 1 reply; 7+ messages in thread
From: gregkh @ 2026-07-21  9:14 UTC (permalink / raw)
  To: theo.lebrun, nb, pabeni; +Cc: stable


The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 27f575836cfebbf872dec020428742b10650a955
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072141-overrate-gratified-54e6@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 27f575836cfebbf872dec020428742b10650a955 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Lebrun?= <theo.lebrun@bootlin.com>
Date: Thu, 2 Jul 2026 17:37:02 +0200
Subject: [PATCH] net: macb: drop in-flight Tx SKBs on close
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The MACB driver has since forever leaked the outgoing SKBs that
have not yet been marked as completed. They live in queue->tx_skb
which gets freed without remorse nor checking.

macb_free_consistent() gets called in a few codepaths, but only close will
trigger the added expressions. In macb_open() and macb_alloc_consistent()
failure cases, queues' tx_skb just got allocated and are empty.

Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver")
Cc: stable@vger.kernel.org
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index fd282a1700fb..d394f1f43b68 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -2668,8 +2668,25 @@ static void macb_free_consistent(struct macb *bp)
 	dma_free_coherent(dev, size, bp->queues[0].rx_ring, bp->queues[0].rx_ring_dma);
 
 	for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-		kfree(queue->tx_skb);
-		queue->tx_skb = NULL;
+		if (queue->tx_skb) {
+			unsigned int dropped = 0, tail;
+
+			for (tail = queue->tx_tail; tail != queue->tx_head;
+			     tail++) {
+				if (macb_tx_skb(queue, tail)->skb)
+					dropped++;
+				macb_tx_unmap(bp, macb_tx_skb(queue, tail), 0);
+			}
+
+			queue->stats.tx_dropped += dropped;
+			bp->dev->stats.tx_dropped += dropped;
+
+			kfree(queue->tx_skb);
+			queue->tx_skb = NULL;
+		}
+
+		queue->tx_head = 0;
+		queue->tx_tail = 0;
 		queue->tx_ring = NULL;
 		queue->rx_ring = NULL;
 	}


^ permalink raw reply related	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-07-29 16:24 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-21  9:14 FAILED: patch "[PATCH] net: macb: drop in-flight Tx SKBs on close" failed to apply to 5.15-stable tree gregkh
2026-07-29 16:24 ` [PATCH 5.15.y 1/6] net: macb: simplify/cleanup NAPI reschedule checking Sasha Levin
2026-07-29 16:24   ` [PATCH 5.15.y 2/6] net: macb: use NAPI for TX completion path Sasha Levin
2026-07-29 16:24   ` [PATCH 5.15.y 3/6] net: macb: remove illusion about TBQPH/RBQPH being per-queue Sasha Levin
2026-07-29 16:24   ` [PATCH 5.15.y 4/6] net: macb: move ring size computation to functions Sasha Levin
2026-07-29 16:24   ` [PATCH 5.15.y 5/6] net: macb: single dma_alloc_coherent() for DMA descriptors Sasha Levin
2026-07-29 16:24   ` [PATCH 5.15.y 6/6] net: macb: drop in-flight Tx SKBs on close Sasha Levin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.