[PATCH net] eth: bnxt: fix missing ring index trim on error path

[PATCH net] eth: bnxt: fix missing ring index trim on error path

[Jakub Kicinski]

Commit under Fixes converted tx_prod to be free running but missed
masking it on the Tx error path. This crashes on error conditions,
for example when DMA mapping fails.

Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: michael.chan@broadcom.com
CC: pavan.chebbi@broadcom.com
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 8725e1e13908..c8e3468eee61 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -787,7 +787,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	dev_kfree_skb_any(skb);
 tx_kick_pending:
 	if (BNXT_TX_PTP_IS_SET(lflags)) {
-		txr->tx_buf_ring[txr->tx_prod].is_ts_pkt = 0;
+		txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].is_ts_pkt = 0;
 		atomic64_inc(&bp->ptp_cfg->stats.ts_err);
 		if (!(bp->fw_cap & BNXT_FW_CAP_TX_TS_CMP))
 			/* set SKB to err so PTP worker will clean up */
@@ -795,7 +795,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 	if (txr->kick_pending)
 		bnxt_txr_db_kick(bp, txr, txr->tx_prod);
-	txr->tx_buf_ring[txr->tx_prod].skb = NULL;
+	txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].skb = NULL;
 	dev_core_stats_tx_dropped_inc(dev);
 	return NETDEV_TX_OK;
 }
-- 
2.49.0

Re: [PATCH net] eth: bnxt: fix missing ring index trim on error path

[Michael Chan]

[-- Attachment #1: Type: text/plain, Size: 444 bytes --]

On Mon, Apr 14, 2025 at 7:32 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> Commit under Fixes converted tx_prod to be free running but missed
> masking it on the Tx error path. This crashes on error conditions,
> for example when DMA mapping fails.
>
> Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Thanks.
Reviewed-by: Michael Chan <michael.chan@broadcom.com>

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4196 bytes --]

Re: [PATCH net] eth: bnxt: fix missing ring index trim on error path

[Simon Horman]

On Mon, Apr 14, 2025 at 09:35:54AM -0700, Michael Chan wrote:
> On Mon, Apr 14, 2025 at 7:32 AM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > Commit under Fixes converted tx_prod to be free running but missed
> > masking it on the Tx error path. This crashes on error conditions,
> > for example when DMA mapping fails.
> >
> > Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> 
> Thanks.
> Reviewed-by: Michael Chan <michael.chan@broadcom.com>

FTR this now appears in net as
commit 12f2d033fae9 ("eth: bnxt: fix missing ring index trim on error path")