[PATCH net 0/3] net: stmmac: fix DMA allocation and IRQ failure cleanup

[PATCH net 0/3] net: stmmac: fix DMA allocation and IRQ failure cleanup

[Karl Mehltretter]

A DMA error-path review for the BeagleV Ahead found three bugs in the
common STMMAC code. Partial allocation can call buffer cleanup without
the metadata it indexes. A later TX allocation failure leaks the RX
resources allocated first. IRQ registration failure can release
descriptors and packet buffers while DMA remains active.

Patches 1 and 2 fix allocation cleanup. Patch 3 fixes the IRQ failure
unwind independently.

Testing:

- BeagleV Ahead, TH1520 DWMAC 3.70a: guarded baseline/fixed boots for RX
  and TX allocation failures and normal-open IRQ failure. Baseline runs
  reached the guarded unsafe boundaries. Fixed runs cleared the tracked
  resources and stopped DMA before cleanup.
- A matched follow-up applied the same RTL8211F-VD resume repair to all
  baseline and fixed kernels. At both 100 and 1000 Mbit/s, each variant
  passed eight close/open cycles (32 total), delay-register checks,
  pings and bidirectional 1 MiB SHA-256 transfers with no RX CRC or
  DMA-API errors.
- Native-XDP IRQ failure was exercised on the same board. The baseline
  reached IRQ unwind with DMA active and required a test-only rescue;
  the fixed kernel stopped DMA before unwind. Both reached descriptor
  cleanup with DMA inactive and no DMA-API errors.
- The physical native-XDP pair used CONFIG_BPF_JIT=n in both variants
  to bypass an independent RISC-V execmem Oops after the STMMAC unwind.
  The default configuration's XDP-open path remains covered by the QEMU
  fault-injection matrix.
- The exact combined code passed 24 of 24 checked 64 MiB transfers on
  fresh BeagleV Ahead boots with no DMA-API errors.
- QEMU orangepi-pc/dwmac-sun8i: 36 of 36 cold boots passed across the
  allocation and IRQ matrices, including XDP-open IRQ failure.
- The exact combined code cross-built the STMMAC objects and BeagleV
  Ahead DTB with a RISC-V defconfig and DWMAC_THEAD enabled.

The guards and fault-injection hooks are test-only and are not in this
series. The RTL8211F-VD repair is being submitted separately.

Based on 24a19b953e2a (Linux 7.3-rc7).

Karl Mehltretter (3):
  net: stmmac: handle partially allocated DMA queues
  net: stmmac: free RX resources when TX allocation fails
  net: stmmac: stop DMA when IRQ registration fails

 .../net/ethernet/stmicro/stmmac/stmmac_main.c | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)


base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
-- 
2.39.5 (Apple Git-154)

[PATCH net 1/3] net: stmmac: handle partially allocated DMA queues

[Karl Mehltretter]

DMA allocation failure unwinds every configured queue, including the
failed queue and queues not yet allocated. The cleanup helpers then
dereference buffer arrays that may not exist.

Only traverse allocated buffer arrays. Clear freed pointers because the
queue structures persist and XDP reconfiguration can reuse them.

Found by inspection. On a BeagleV Ahead (TH1520), fault injection at
the RX buffer metadata and TX DMA metadata allocations reached these
invalid cleanup paths before a test guard stopped them. With this
change, cleanup completed without the guard.

Fixes: 54139cf3bb33 ("net: stmmac: adding multiple buffers for rx")
Fixes: ce736788e8a9 ("net: stmmac: adding multiple buffers for TX")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 .../net/ethernet/stmicro/stmmac/stmmac_main.c | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index b837e8e27..495ff7aef 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2144,10 +2144,12 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
 	void *addr;
 
 	/* Release the DMA RX socket buffers */
-	if (rx_q->xsk_pool)
-		dma_free_rx_xskbufs(priv, dma_conf, queue);
-	else
-		dma_free_rx_skbufs(priv, dma_conf, queue);
+	if (rx_q->buf_pool) {
+		if (rx_q->xsk_pool)
+			dma_free_rx_xskbufs(priv, dma_conf, queue);
+		else
+			dma_free_rx_skbufs(priv, dma_conf, queue);
+	}
 
 	rx_q->buf_alloc_num = 0;
 	rx_q->xsk_pool = NULL;
@@ -2161,13 +2163,17 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
 	size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
 
 	dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy);
+	rx_q->dma_erx = NULL;
+	rx_q->dma_rx = NULL;
 
 	if (xdp_rxq_info_is_reg(&rx_q->xdp_rxq))
 		xdp_rxq_info_unreg(&rx_q->xdp_rxq);
 
 	kfree(rx_q->buf_pool);
+	rx_q->buf_pool = NULL;
 	if (rx_q->page_pool)
 		page_pool_destroy(rx_q->page_pool);
+	rx_q->page_pool = NULL;
 }
 
 static void free_dma_rx_desc_resources(struct stmmac_priv *priv,
@@ -2196,7 +2202,8 @@ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
 	void *addr;
 
 	/* Release the DMA TX socket buffers */
-	dma_free_tx_skbufs(priv, dma_conf, queue);
+	if (tx_q->tx_skbuff_dma && tx_q->tx_skbuff)
+		dma_free_tx_skbufs(priv, dma_conf, queue);
 
 	if (priv->extend_desc) {
 		addr = tx_q->dma_etx;
@@ -2209,9 +2216,14 @@ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
 	size = stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size;
 
 	dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
+	tx_q->dma_etx = NULL;
+	tx_q->dma_entx = NULL;
+	tx_q->dma_tx = NULL;
 
 	kfree(tx_q->tx_skbuff_dma);
+	tx_q->tx_skbuff_dma = NULL;
 	kfree(tx_q->tx_skbuff);
+	tx_q->tx_skbuff = NULL;
 }
 
 static void free_dma_tx_desc_resources(struct stmmac_priv *priv,
-- 
2.39.5 (Apple Git-154)

Re: [PATCH net 1/3] net: stmmac: handle partially allocated DMA queues

[Maxime Chevallier]

Hi,

On 10/14/26 08:26, Karl Mehltretter wrote:
> DMA allocation failure unwinds every configured queue, including the
> failed queue and queues not yet allocated. The cleanup helpers then
> dereference buffer arrays that may not exist.
> 
> Only traverse allocated buffer arrays. Clear freed pointers because the
> queue structures persist and XDP reconfiguration can reuse them.
> 
> Found by inspection. On a BeagleV Ahead (TH1520), fault injection at
> the RX buffer metadata and TX DMA metadata allocations reached these
> invalid cleanup paths before a test guard stopped them. With this
> change, cleanup completed without the guard.
> 
> Fixes: 54139cf3bb33 ("net: stmmac: adding multiple buffers for rx")
> Fixes: ce736788e8a9 ("net: stmmac: adding multiple buffers for TX")
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

Please look at https://lore.kernel.org/netdev/20261012142458.2845385-1-dinghui1111@163.com/ .

LLMs keep finding the same bugs again and again, make sure you ask
it if there isn't already an in-flight patch for it before sending it :)

Maxime


> ---
>  .../net/ethernet/stmicro/stmmac/stmmac_main.c | 22 ++++++++++++++-----
>  1 file changed, 17 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index b837e8e27..495ff7aef 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -2144,10 +2144,12 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
>  	void *addr;
>  
>  	/* Release the DMA RX socket buffers */
> -	if (rx_q->xsk_pool)
> -		dma_free_rx_xskbufs(priv, dma_conf, queue);
> -	else
> -		dma_free_rx_skbufs(priv, dma_conf, queue);
> +	if (rx_q->buf_pool) {
> +		if (rx_q->xsk_pool)
> +			dma_free_rx_xskbufs(priv, dma_conf, queue);
> +		else
> +			dma_free_rx_skbufs(priv, dma_conf, queue);
> +	}
>  
>  	rx_q->buf_alloc_num = 0;
>  	rx_q->xsk_pool = NULL;
> @@ -2161,13 +2163,17 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
>  	size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
>  
>  	dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy);
> +	rx_q->dma_erx = NULL;
> +	rx_q->dma_rx = NULL;
>  
>  	if (xdp_rxq_info_is_reg(&rx_q->xdp_rxq))
>  		xdp_rxq_info_unreg(&rx_q->xdp_rxq);
>  
>  	kfree(rx_q->buf_pool);
> +	rx_q->buf_pool = NULL;
>  	if (rx_q->page_pool)
>  		page_pool_destroy(rx_q->page_pool);
> +	rx_q->page_pool = NULL;
>  }
>  
>  static void free_dma_rx_desc_resources(struct stmmac_priv *priv,
> @@ -2196,7 +2202,8 @@ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
>  	void *addr;
>  
>  	/* Release the DMA TX socket buffers */
> -	dma_free_tx_skbufs(priv, dma_conf, queue);
> +	if (tx_q->tx_skbuff_dma && tx_q->tx_skbuff)
> +		dma_free_tx_skbufs(priv, dma_conf, queue);
>  
>  	if (priv->extend_desc) {
>  		addr = tx_q->dma_etx;
> @@ -2209,9 +2216,14 @@ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
>  	size = stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size;
>  
>  	dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
> +	tx_q->dma_etx = NULL;
> +	tx_q->dma_entx = NULL;
> +	tx_q->dma_tx = NULL;
>  
>  	kfree(tx_q->tx_skbuff_dma);
> +	tx_q->tx_skbuff_dma = NULL;
>  	kfree(tx_q->tx_skbuff);
> +	tx_q->tx_skbuff = NULL;
>  }
>  
>  static void free_dma_tx_desc_resources(struct stmmac_priv *priv,

[PATCH net 2/3] net: stmmac: free RX resources when TX allocation fails

[Karl Mehltretter]

alloc_dma_desc_resources() allocates every RX queue before allocating
TX queues. If TX allocation fails, its error path only frees TX
resources and leaks all RX resources.

Free the RX resources after the TX allocator unwinds its queues.

Found by inspection. On a BeagleV Ahead (TH1520), forcing TX DMA
metadata allocation to fail left the RX cleanup event absent. With this
change, both TX and RX resources were released.

Fixes: 71fedb0198cb ("net: stmmac: break some functions into RX and TX scopes")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 495ff7aef..8fd7d2173 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2425,6 +2425,8 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv,
 		return ret;
 
 	ret = alloc_dma_tx_desc_resources(priv, dma_conf);
+	if (ret)
+		free_dma_rx_desc_resources(priv, dma_conf);
 
 	return ret;
 }
-- 
2.39.5 (Apple Git-154)

Re: [PATCH net 2/3] net: stmmac: free RX resources when TX allocation fails

[Maxime Chevallier]

Hi,

On 10/14/26 08:27, Karl Mehltretter wrote:
> alloc_dma_desc_resources() allocates every RX queue before allocating
> TX queues. If TX allocation fails, its error path only frees TX
> resources and leaks all RX resources.
> 
> Free the RX resources after the TX allocator unwinds its queues.
> 
> Found by inspection. On a BeagleV Ahead (TH1520), forcing TX DMA
> metadata allocation to fail left the RX cleanup event absent. With this
> change, both TX and RX resources were released.
> 
> Fixes: 71fedb0198cb ("net: stmmac: break some functions into RX and TX scopes")
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

Also covered by https://lore.kernel.org/netdev/20261012142458.2845385-1-dinghui1111@163.com/.

Thanks,

Maxime

> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 495ff7aef..8fd7d2173 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -2425,6 +2425,8 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv,
>  		return ret;
>  
>  	ret = alloc_dma_tx_desc_resources(priv, dma_conf);
> +	if (ret)
> +		free_dma_rx_desc_resources(priv, dma_conf);
>  
>  	return ret;
>  }

[PATCH net 3/3] net: stmmac: stop DMA when IRQ registration fails

[Karl Mehltretter]

Both __stmmac_open() and stmmac_xdp_open() start DMA before requesting
IRQs. If IRQ registration fails, their error paths release descriptors
and packet buffers while the DMA channels remain active.

Stop all DMA channels before releasing those resources, matching the
normal close paths.

Found by inspection. On a BeagleV Ahead (TH1520), fault injection in
both normal-open and native-XDP-open paths reached IRQ unwind with DMA
active on the baseline kernel. With this change, the DMA process states
were idle before unwind and resource cleanup in both paths.

Fixes: 523f11b5d4fd ("net: stmmac: move hardware setup for stmmac_open to new function")
Fixes: ac746c8520d9 ("net: stmmac: enhance XDP ZC driver level switching performance")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8fd7d2173..5c4df26a6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -4206,6 +4206,7 @@ irq_error:
 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
 		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
 
+	stmmac_stop_all_dma(priv);
 	stmmac_release_ptp(priv);
 init_error:
 	return ret;
@@ -7259,6 +7260,7 @@ int stmmac_xdp_open(struct net_device *dev)
 irq_error:
 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
 		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
+	stmmac_stop_all_dma(priv);
 
 init_error:
 	free_dma_desc_resources(priv, &priv->dma_conf);
-- 
2.39.5 (Apple Git-154)

Re: [PATCH net 3/3] net: stmmac: stop DMA when IRQ registration fails

[Daniel Machon]

Hi,

> Both __stmmac_open() and stmmac_xdp_open() start DMA before requesting
> IRQs. If IRQ registration fails, their error paths release descriptors
> and packet buffers while the DMA channels remain active.
> 
> Stop all DMA channels before releasing those resources, matching the
> normal close paths.
> 
> Found by inspection. On a BeagleV Ahead (TH1520), fault injection in
> both normal-open and native-XDP-open paths reached IRQ unwind with DMA
> active on the baseline kernel. With this change, the DMA process states
> were idle before unwind and resource cleanup in both paths.

This fix looks suspiciously similar to a fix already accepted into net-next [1].

> 
> Fixes: 523f11b5d4fd ("net: stmmac: move hardware setup for stmmac_open to new function")
> Fixes: ac746c8520d9 ("net: stmmac: enhance XDP ZC driver level switching performance")
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 8fd7d2173..5c4df26a6 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -4206,6 +4206,7 @@ irq_error:
>  	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
>  		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
>  
> +	stmmac_stop_all_dma(priv);
>  	stmmac_release_ptp(priv);
>  init_error:
>  	return ret;
> @@ -7259,6 +7260,7 @@ int stmmac_xdp_open(struct net_device *dev)
>  irq_error:
>  	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
>  		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
> +	stmmac_stop_all_dma(priv);
>  
>  init_error:
>  	free_dma_desc_resources(priv, &priv->dma_conf);
> -- 
> 2.39.5 (Apple Git-154)
> 

[1] https://lore.kernel.org/netdev/32EB352EB66D74E7+20260827025415.2684733-1-zhaojinming@uniontech.com/