Re: [BUG] net: ethernet: cortina: gemini: skb leak in gmac_rx() causes kernel lockup under sustained RX load

Re: [BUG] net: ethernet: cortina: gemini: skb leak in gmac_rx() causes kernel lockup under sustained RX load

[Linus Walleij]

Hi Andreas,

thanks for digging into this, I have wondered why this happens for a long
time but I'm not the best net developer myself.

On Sun, Mar 29, 2026 at 12:05 PM Andreas Haarmann-Thiemann
<eitschman@nebelreich.de> wrote:

> diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
> --- a/drivers/net/ethernet/cortina/gemini.c
> +++ b/drivers/net/ethernet/cortina/gemini.c
>
> @@ -1491,6 +1491,10 @@ static int gmac_rx(struct napi_struct *napi, int budget)
>                               gpage = gmac_get_queue_page(geth, port, mapping + PAGE_SIZE);
>                               if (!gpage) {
>                                               dev_err(geth->dev, "could not find mapping\n");
> +                                             if (skb) {
> +                                                            napi_free_frags(&port->napi);
> +                                                            skb = NULL;
> +                                             }
>                                               port->stats.rx_dropped++;
>                                               continue;
>                               }

This looks right to me, can you send a proper patch, or provide your
Signed-off-by in this thread so I can create a patch from this inline code?

The kernel process requires a "certificate of origin" i.e. Signed-off-by,
described a bit down in this document:
https://docs.kernel.org/process/submitting-patches.html

Yours,
Linus Walleij

AW: [BUG] net: ethernet: cortina: gemini: skb leak in gmac_rx() causes kernel lockup under sustained RX load

[Andreas Haarmann-Thiemann]

Hello Linus,

thank you for the confirmation!

Here is my Signed-off-by:

Signed-off-by: Andreas Haarmann-Thiemann <eitschman@nebelreich.de>

Please feel free to create the patch from the inline code.

Best regards,
Andreas Haarmann-Thiemann

-----Ursprüngliche Nachricht-----
Von: Linus Walleij <linusw@kernel.org> 
Gesendet: Sonntag, 29. März 2026 20:54
An: Andreas Haarmann-Thiemann <eitschman@nebelreich.de>
Cc: ulli.kroll@googlemail.com; netdev@vger.kernel.org; linux-arm-kernel@lists.infradead.org
Betreff: Re: [BUG] net: ethernet: cortina: gemini: skb leak in gmac_rx() causes kernel lockup under sustained RX load

Hi Andreas,

thanks for digging into this, I have wondered why this happens for a long time but I'm not the best net developer myself.

On Sun, Mar 29, 2026 at 12:05 PM Andreas Haarmann-Thiemann <eitschman@nebelreich.de> wrote:

> diff --git a/drivers/net/ethernet/cortina/gemini.c 
> b/drivers/net/ethernet/cortina/gemini.c
> --- a/drivers/net/ethernet/cortina/gemini.c
> +++ b/drivers/net/ethernet/cortina/gemini.c
>
> @@ -1491,6 +1491,10 @@ static int gmac_rx(struct napi_struct *napi, int budget)
>                               gpage = gmac_get_queue_page(geth, port, mapping + PAGE_SIZE);
>                               if (!gpage) {
>                                               dev_err(geth->dev, 
> "could not find mapping\n");
> +                                             if (skb) {
> +                                                            napi_free_frags(&port->napi);
> +                                                            skb = NULL;
> +                                             }
>                                               port->stats.rx_dropped++;
>                                               continue;
>                               }

This looks right to me, can you send a proper patch, or provide your Signed-off-by in this thread so I can create a patch from this inline code?

The kernel process requires a "certificate of origin" i.e. Signed-off-by, described a bit down in this document:
https://docs.kernel.org/process/submitting-patches.html

Yours,
Linus Walleij