All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jakub Kicinski <kuba@kernel.org>
To: davem@davemloft.net
Cc: netdev@vger.kernel.org, edumazet@google.com, pabeni@redhat.com,
	andrew+netdev@lunn.ch, horms@kernel.org,
	michael.chan@broadcom.com, pavan.chebbi@broadcom.com,
	hawk@kernel.org, john.fastabend@gmail.com, sdf@fomichev.me,
	eddie.wai@broadcom.com, prashant@broadcom.com,
	huangjw@broadcom.com, gospo@broadcom.com, brett.creeley@amd.com,
	ap420073@gmail.com, joe@dama.to, Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH net 2/5] eth: bnxt: resize Rx head buffers when rx-copybreak changes
Date: Tue, 27 Oct 2026 16:49:37 -0700	[thread overview]
Message-ID: <20261027234940.1267225-3-kuba@kernel.org> (raw)
In-Reply-To: <20261027234940.1267225-1-kuba@kernel.org>

Since rx-copybreak became configurable, bnxt_set_ring_params() sizes
the head buffers to fit at least rx_copybreak bytes, and the copybreak
path in bnxt_copy_data() syncs rx_copybreak bytes of the head buffer.
bnxt_set_tunable() however only updates bp->rx_copybreak, and nothing
on the open path recalculates the ring parameters. After raising
rx-copybreak the head buffers keep their old size until some other
setting changes, and bnxt_copy_data() syncs past their end, into the
next buffer in the page or past the end of the page:

  DMA-API: bnxt_en 0000:01:00.0: device driver tries to sync DMA memory it has not allocated [device address=0x00000002aa210c40] [size=1024 bytes]
  WARNING: kernel/dma/debug.c:1162 at check_sync+0x577/0x1eb0, CPU#22: swapper/22/0
  Call Trace:
   <IRQ>
   debug_dma_sync_single_for_cpu+0x66/0x90
   bnxt_copy_data+0x12f/0x290
   bnxt_rx_pkt+0x24ea/0x50f0
   __bnxt_poll_work+0x42c/0xc00
   bnxt_poll_p5+0x579/0x17a0
   __napi_poll+0x8b/0x2c0
   net_rx_action+0x58f/0xbb0

Here the head buffers were still sized for the 640B HDS threshold,
four 1kB buffers per page, while rx-copybreak was raised to 1024.
Without coherent DMA or with swiotlb the oversized sync can corrupt
a neighboring buffer owned by the device or by an skb.

The device must be down for rx-copybreak to change, so recalculate the
ring parameters right away, like bnxt_set_ringparam() does.

Hit while testing patch 1, tested on BCM57504 - boot; set rx-copybreak
to 1024 with the link down (CONFIG_DMA_API_DEBUG); ifup.

Fixes: 152f4da05aee ("bnxt_en: add support for rx-copybreak ethtool command")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 622e89587e5d..ef4bea4a0f8c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -4601,6 +4601,7 @@ static int bnxt_set_tunable(struct net_device *dev,
 			if (netif_running(dev))
 				return -EBUSY;
 			bp->rx_copybreak = rx_copybreak;
+			bnxt_set_ring_params(bp);
 		}
 		return 0;
 	case ETHTOOL_PFC_PREVENTION_TOUT:
-- 
2.56.0


  parent reply	other threads:[~2026-10-27 23:49 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27 23:49 [PATCH net 0/5] eth: bnxt: fix Rx buffer leaks under OOM Jakub Kicinski
2026-10-27 23:49 ` [PATCH net 1/5] eth: bnxt: recycle agg buffers when Rx head buffer allocation fails Jakub Kicinski
2026-10-28  6:58   ` Michael Chan
2026-10-28 23:52   ` netdev-bot+sashiko
2026-10-29  0:49     ` Jakub Kicinski
2026-10-27 23:49 ` Jakub Kicinski [this message]
2026-10-28 23:52   ` [PATCH net 2/5] eth: bnxt: resize Rx head buffers when rx-copybreak changes netdev-bot+sashiko
2026-10-29  0:58     ` Jakub Kicinski
2026-10-29  5:32       ` Michael Chan
2026-10-27 23:49 ` [PATCH net 3/5] eth: bnxt: don't leak buffers when XDP agg buffer allocation fails Jakub Kicinski
2026-10-27 23:49 ` [PATCH net 4/5] eth: bnxt: free XDP frags when xdp_do_redirect() fails Jakub Kicinski
2026-10-29  5:49   ` Michael Chan
2026-10-27 23:49 ` [PATCH net 5/5] eth: bnxt: hand XDP frags over to the copybreak skb Jakub Kicinski
2026-10-29  5:59 ` [PATCH net 0/5] eth: bnxt: fix Rx buffer leaks under OOM Michael Chan
2026-10-29 17:09   ` Andy Gospodarek
2026-10-29 16:10 ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261027234940.1267225-3-kuba@kernel.org \
    --to=kuba@kernel.org \
    --cc=andrew+netdev@lunn.ch \
    --cc=ap420073@gmail.com \
    --cc=brett.creeley@amd.com \
    --cc=davem@davemloft.net \
    --cc=eddie.wai@broadcom.com \
    --cc=edumazet@google.com \
    --cc=gospo@broadcom.com \
    --cc=hawk@kernel.org \
    --cc=horms@kernel.org \
    --cc=huangjw@broadcom.com \
    --cc=joe@dama.to \
    --cc=john.fastabend@gmail.com \
    --cc=michael.chan@broadcom.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pavan.chebbi@broadcom.com \
    --cc=prashant@broadcom.com \
    --cc=sdf@fomichev.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.