From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 58B673E5EC0; Mon, 17 Aug 2026 14:59:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978790; cv=none; b=Ww4mr44jrwJwX5xHx55J1Et1mUqqU2sTubdUZbyCQgQm2RLilJPKPGUIKv4SC7kYch9SoVsRnmQ7FKJBhTF7RSKN/d5/VQOif3q/N0+a7wBfTLpoTyDCni4A0GWaFDw6M2bkp/PjpzuazDdzeUnPzxSAGajVWuOChbdPcJIFdi4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978790; c=relaxed/simple; bh=cKRgqDWLnWNEjtb++h9CXiAI9+78X/E5KytdrMnF5Po=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=a++GpxcBJD0Lmxio2f87TeF78IU34D+gmGhJiAc44orq8g6dnwCmQ7ZfxaSN00kP7s3kiWdOPsAKzSMqOUUhayEXktKyxRGKCsUD9hoXg3k9vLiqLUaBdWOh/pz0kpZ6xhQ7hWMoEFtzGk18Do8t9a+xKotUpWQwj9MkNNfSfXQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ROH1VYnY; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ROH1VYnY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF4961F000E9; Mon, 17 Aug 2026 14:59:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786978789; bh=ECRIpxlBGs2DqIWXumieBodyWbFy6pcx6Guqo5qMhx4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ROH1VYnY2Qp/3c+wFnRLmtmH40LJfYcAjfd6kJwEdUTosmJeV7m1xtm4EAdSy74qE jw58qQIObAnNNlqzdyx/ITKvi0ehHq5y2zurjaq9zJt6fxGcIn6G6NElbZUEoFpczO ULYwJjyHKUtKy+Ctp8xkm2iEu26WgI2GWzOvIPaw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sukhdeep Singh , Yangyu Chen , Mina Almasry , Jakub Kicinski Subject: [PATCH 6.6 123/156] net: atlantic: free RX pages of consumed but not refilled buffers Date: Mon, 17 Aug 2026 15:34:17 +0200 Message-ID: <20260817132539.475016914@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132534.666299318@linuxfoundation.org> References: <20260817132534.666299318@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yangyu Chen commit e8e7471ef686b6c002218fee9671cc61992ae01a upstream. aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [sw_tail, sw_head) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down. Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still gets here on the unwind path. Cc: stable@vger.kernel.org # v5.2+ Fixes: 46f4c29d9de6 ("net: aquantia: optimize rx performance by page reuse strategy") Reviewed-by: Sukhdeep Singh Signed-off-by: Yangyu Chen Acked-by: Mina Almasry Link: https://patch.msgid.link/tencent_607CBA8237DA438E36B844318B21538DE008@qq.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c @@ -926,15 +926,29 @@ err_exit: void aq_ring_rx_deinit(struct aq_ring_s *self) { - if (!self) + unsigned int i; + + if (!self || !self->buff_ring) return; - for (; self->sw_head != self->sw_tail; - self->sw_head = aq_ring_next_dx(self, self->sw_head)) { - struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head]; + /* Release every page still owned by the ring. + * + * Walking [sw_head, sw_tail) is not enough: refill is batched + * (aq_ring_rx_fill() waits for AQ_CFG_RX_REFILL_THRES free slots), + * so slots that were cleaned but not yet reposted accumulate in the + * [sw_tail, sw_head) gap, and they keep their page for reuse. Walk + * the whole ring and release whatever is left. + */ + for (i = 0; i < self->size; i++) { + struct aq_ring_buff_s *buff = &self->buff_ring[i]; + + if (!buff->rxdata.page) + continue; aq_free_rxpage(&buff->rxdata, aq_nic_get_dev(self->aq_nic)); } + + self->sw_head = self->sw_tail; } void aq_ring_free(struct aq_ring_s *self)