Re: [PATCH net] net: axienet: don't advance the TX ring head before the descriptor is ready

[Simon Horman <horms@kernel.org>]

On Tue, Oct 13, 2026 at 06:25:06PM +0000, Josef Bacik wrote:
> axienet_start_xmit_dmaengine() bumps lp->tx_ring_head before
> skb_to_sgvec(), dma_map_sg() and device_prep_slave_sg(), and none of
> their error paths undo it.  The skb is freed and nothing is submitted,
> but the slot stays claimed.  axienet_dma_tx_cb() walks tx_ring_tail
> once per completion, so the next completion lands on the abandoned slot
> and dereferences whatever skb pointer is left there: NULL if the slot
> was never used or was already completed, or a stale skb that gets
> consumed a second time.  Every completion after that is accounted
> against the wrong slot.
> 
> dma_map_sg() and device_prep_slave_sg() can fail at runtime, and so can
> skb_to_sgvec() on a malformed skb.  Only advance tx_ring_head once
> those have succeeded.  The completion callback can't run before
> dmaengine_submit(), so claiming the slot just before that is fine.
> 
> dmaengine_submit() itself can also fail on xilinx_dma after a channel
> error, and its return isn't checked either.  That's a separate problem
> and isn't changed here.
> 
> This was found by the Sashiko AI review of the skbuff BUG_ON() series.
> 
> Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support")
> Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f732895b@toxicpanda.com/
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> ---
> Compile-tested only, I don't have the hardware.  The bug is in the error
> paths, which are easy to see from the diff: every goto after the old
> increment returns without submitting anything.

Reviewed-by: Simon Horman <horms@kernel.org>