Re: [net-next v11 4/7] net: mtip: The L2 switch driver for imx287

Paolo Abeni
2025-05-06T12:50:21Z

On 5/4/25 4:55 PM, Lukasz Majewski wrote:
> + /* This does 16 byte alignment, exactly what we need.
> + * The packet length includes FCS, but we don't want to
> + * include that when passing upstream as it messes up
> + * bridging applications.
> + */
> + skb = netdev_alloc_skb(pndev, pkt_len + NET_IP_ALIGN);
> + if (unlikely(!skb)) {
> + dev_dbg(&fep->pdev->dev,
> + "%s: Memory squeeze, dropping packet.\n",
> + pndev->name);
> + pndev->stats.rx_dropped++;
> + goto err_mem;
> + } else {
> + skb_reserve(skb, NET_IP_ALIGN);
> + skb_put(skb, pkt_len); /* Make room */
> + skb_copy_to_linear_data(skb, data, pkt_len);
> + skb->protocol = eth_type_trans(skb, pndev);
> + napi_gro_receive(&fep->napi, skb);
> + }
> +
> + bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, data,
> + bdp->cbd_datlen,
> + DMA_FROM_DEVICE);
> + if (unlikely(dma_mapping_error(&fep->pdev->dev,
> + bdp->cbd_bufaddr))) {
> + dev_err(&fep->pdev->dev,
> + "Failed to map descriptor rx buffer\n");
> + pndev->stats.rx_errors++;
> + pndev->stats.rx_dropped++;
> + dev_kfree_skb_any(skb);
> + goto err_mem;
> + }

This is doing the mapping and ev. dropping the skb _after_ pushing the
skb up the stack, you must attempt the mapping first.

> +static void mtip_free_buffers(struct net_device *dev)
> +{
> + struct mtip_ndev_priv *priv = netdev_priv(dev);
> + struct switch_enet_private *fep = priv->fep;
> + struct sk_buff *skb;
> + struct cbd_t *bdp;
> + int i;
> +
> + bdp = fep->rx_bd_base;
> + for (i = 0; i < RX_RING_SIZE; i++) {
> + skb = fep->rx_skbuff[i];
> +
> + if (bdp->cbd_bufaddr)
> + dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
> + MTIP_SWITCH_RX_FRSIZE,
> + DMA_FROM_DEVICE);
> + if (skb)
> + dev_kfree_skb(skb);

I suspect that on error paths mtip_free_buffers() can be invoked
multiple consecutive times with any successful allocation in between:
skb will be freed twice. Likely you need to clear fep->rx_skbuff[i] here.

Side note: this patch is way too big for a proper review: you need to
break it in multiple smaller ones, introducing the basic features
separately.

Cheers,

Paolo