[PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[Denis Arefev]

unmap_partial_tx_skb() walks the TX ring entries between first_entry
and entry to release the DMA mappings of the fragments that were
mapped successfully before a mapping error, but it never advances
first_entry inside the loop. Whenever the failed fragment is not
the first one, entry is ahead of first_entry and the loop condition
first_entry != entry never becomes false, so the function spins
forever.

The function is called from happy_meal_start_xmit() with
hp->happy_lock held and interrupts disabled, so the infinite loop
leads to a hard lockup.

Now that the loop lockup is fixed, a secondary bug becomes reachable:
the function unmaps the pages but leaves the descriptors in the ring
with the TXFLAG_OWN bit still set. When the driver subsequently
processes a new linear packet, the hardware MAC will advance into these
stale descriptors, causing IOMMU faults, TX ring desynchronization.

Fix both issues by advancing the entry pointer using NEXT_TX() at the
end of the loop, and clearing each descriptor via hme_write_txd()
immediately after performing the DMA unmap.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: ec1f1276022e ("sunhme: Add DMA mapping error checks.")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
Changes since v1:
- Also clear the stale TX descriptors (hme_write_txd(hp, this, 0,0)) after unmapping them.
v1: https://lore.kernel.org/all/20261013103228.37430-1-arefev@swemel.ru/
---
 Compile tested only
 drivers/net/ethernet/sun/sunhme.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index a70f704eb9f3..dace94841a6f 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1965,6 +1965,8 @@ static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping,
 		len = hme_read_desc32(hp, &this->tx_flags);
 		len &= TXFLAG_SIZE;
 		dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE);
+		hme_write_txd(hp, this, 0, 0);
+		first_entry = NEXT_TX(first_entry);
 	}
 }
 
-- 
2.43.0

Re: [PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[Jakub Kicinski]

On Thu, 15 Oct 2026 14:43:54 +0300 Denis Arefev wrote:
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

We don't take LLM fixes for ancient HW drivers
-- 
pw-bot: reject

Re: [PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[Sean Anderson]

On 10/20/26 15:40, Jakub Kicinski wrote:
> On Thu, 15 Oct 2026 14:43:54 +0300 Denis Arefev wrote:
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> We don't take LLM fixes for ancient HW drivers

FWIW this does appear to be a real infinite loop. There's nothing
in the body that modifies the variables used in the condition. Based
on the original commit, the testing probably did not actually involve
exercising this function. I suppose no one has complained about this
for the same reason no one complained about unhandled DMA mapping
errors (DMA mapping mostly succeeds).

[1] https://lore.kernel.org/netdev/20141031.134354.207893264084946385.davem@davemloft.net/