* [PATCH net 1/3] net: libwx: remove duplicate page_pool_put_full_page()
2025-07-09 6:40 [PATCH net 0/3] Fix Rx fatal errors Jiawen Wu
@ 2025-07-09 6:40 ` Jiawen Wu
2025-07-09 11:47 ` Simon Horman
2025-07-09 6:40 ` [PATCH net 2/3] net: libwx: fix the using of Rx buffer DMA Jiawen Wu
2025-07-09 6:40 ` [PATCH net 3/3] net: libwx: properly reset Rx ring descriptor Jiawen Wu
2 siblings, 1 reply; 7+ messages in thread
From: Jiawen Wu @ 2025-07-09 6:40 UTC (permalink / raw)
To: netdev, andrew+netdev, davem, edumazet, kuba, pabeni, horms,
michal.kubiak
Cc: mengyuanlou, duanqiangwen, Jiawen Wu, stable
page_pool_put_full_page() should only be invoked when freeing Rx buffers
or building a skb if the size is too short. At other times, the pages
need to be reused. So remove the redundant page put. In the original
code, double free pages cause kernel panic:
[ 876.949834] __irq_exit_rcu+0xc7/0x130
[ 876.949836] common_interrupt+0xb8/0xd0
[ 876.949838] </IRQ>
[ 876.949838] <TASK>
[ 876.949840] asm_common_interrupt+0x22/0x40
[ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420
[ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d
[ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246
[ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000
[ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e
[ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed
[ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580
[ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000
[ 876.949852] ? cpuidle_enter_state+0xb3/0x420
[ 876.949855] cpuidle_enter+0x29/0x40
[ 876.949857] cpuidle_idle_call+0xfd/0x170
[ 876.949859] do_idle+0x7a/0xc0
[ 876.949861] cpu_startup_entry+0x25/0x30
[ 876.949862] start_secondary+0x117/0x140
[ 876.949864] common_startup_64+0x13e/0x148
[ 876.949867] </TASK>
[ 876.949868] ---[ end trace 0000000000000000 ]---
[ 876.949869] ------------[ cut here ]------------
[ 876.949870] list_del corruption, ffffead40445a348->next is NULL
[ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120
[ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E)
[ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi
[ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary)
[ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE
[ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024
[ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120
[ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8
[ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282
[ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000
[ 876.949942] RDX: 0000000000000105 RSI: 0000000000000001 RDI: 00000000ffffffff
[ 876.949943] RBP: 0000000000000000 R08: 000000010006dfde R09: ffffffff8a47d150
[ 876.949944] R10: ffffffff8a47d150 R11: 0000000000000003 R12: dead000000000122
[ 876.949945] R13: ffff9e3e9e5af700 R14: ffffead40445a348 R15: ffff9e3e9e5af720
[ 876.949946] FS: 0000000000000000(0000) GS:ffff9e3f135be000(0000) knlGS:0000000000000000
[ 876.949947] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 876.949948] CR2: 00007fa58b480048 CR3: 0000000156724000 CR4: 0000000000750ef0
[ 876.949949] PKRU: 55555554
[ 876.949950] Call Trace:
[ 876.949951] <IRQ>
[ 876.949952] __rmqueue_pcplist+0x53/0x2c0
[ 876.949955] alloc_pages_bulk_noprof+0x2e0/0x660
[ 876.949958] __page_pool_alloc_pages_slow+0xa9/0x400
[ 876.949961] page_pool_alloc_pages+0xa/0x20
[ 876.949963] wx_alloc_rx_buffers+0xd7/0x110 [libwx]
[ 876.949967] wx_clean_rx_irq+0x262/0x430 [libwx]
[ 876.949971] wx_poll+0x92/0x130 [libwx]
[ 876.949975] __napi_poll+0x28/0x190
[ 876.949977] net_rx_action+0x301/0x3f0
[ 876.949980] ? srso_alias_return_thunk+0x5/0xfbef5
[ 876.949981] ? profile_tick+0x30/0x70
[ 876.949983] ? srso_alias_return_thunk+0x5/0xfbef5
[ 876.949984] ? srso_alias_return_thunk+0x5/0xfbef5
[ 876.949986] ? timerqueue_add+0xa3/0xc0
[ 876.949988] ? srso_alias_return_thunk+0x5/0xfbef5
[ 876.949989] ? __raise_softirq_irqoff+0x16/0x70
[ 876.949991] ? srso_alias_return_thunk+0x5/0xfbef5
[ 876.949993] ? srso_alias_return_thunk+0x5/0xfbef5
[ 876.949994] ? wx_msix_clean_rings+0x41/0x50 [libwx]
[ 876.949998] handle_softirqs+0xf9/0x2c0
Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
---
drivers/net/ethernet/wangxun/libwx/wx_lib.c | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
index 55e252789db3..7e3d7fb61a52 100644
--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
@@ -174,10 +174,6 @@ static void wx_dma_sync_frag(struct wx_ring *rx_ring,
skb_frag_off(frag),
skb_frag_size(frag),
DMA_FROM_DEVICE);
-
- /* If the page was released, just unmap it. */
- if (unlikely(WX_CB(skb)->page_released))
- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
}
static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring,
@@ -227,10 +223,6 @@ static void wx_put_rx_buffer(struct wx_ring *rx_ring,
struct sk_buff *skb,
int rx_buffer_pgcnt)
{
- if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma)
- /* the page has been released from the ring */
- WX_CB(skb)->page_released = true;
-
/* clear contents of rx_buffer */
rx_buffer->page = NULL;
rx_buffer->skb = NULL;
@@ -2423,9 +2415,6 @@ static void wx_clean_rx_ring(struct wx_ring *rx_ring)
if (rx_buffer->skb) {
struct sk_buff *skb = rx_buffer->skb;
- if (WX_CB(skb)->page_released)
- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
-
dev_kfree_skb(skb);
}
--
2.48.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH net 1/3] net: libwx: remove duplicate page_pool_put_full_page()
2025-07-09 6:40 ` [PATCH net 1/3] net: libwx: remove duplicate page_pool_put_full_page() Jiawen Wu
@ 2025-07-09 11:47 ` Simon Horman
0 siblings, 0 replies; 7+ messages in thread
From: Simon Horman @ 2025-07-09 11:47 UTC (permalink / raw)
To: Jiawen Wu
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
michal.kubiak, mengyuanlou, duanqiangwen, stable
On Wed, Jul 09, 2025 at 02:40:23PM +0800, Jiawen Wu wrote:
...
> diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
> index 55e252789db3..7e3d7fb61a52 100644
> --- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
> +++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
> @@ -174,10 +174,6 @@ static void wx_dma_sync_frag(struct wx_ring *rx_ring,
> skb_frag_off(frag),
> skb_frag_size(frag),
> DMA_FROM_DEVICE);
> -
> - /* If the page was released, just unmap it. */
> - if (unlikely(WX_CB(skb)->page_released))
> - page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
> }
>
> static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring,
> @@ -227,10 +223,6 @@ static void wx_put_rx_buffer(struct wx_ring *rx_ring,
> struct sk_buff *skb,
> int rx_buffer_pgcnt)
> {
> - if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma)
> - /* the page has been released from the ring */
> - WX_CB(skb)->page_released = true;
> -
> /* clear contents of rx_buffer */
> rx_buffer->page = NULL;
> rx_buffer->skb = NULL;
> @@ -2423,9 +2415,6 @@ static void wx_clean_rx_ring(struct wx_ring *rx_ring)
> if (rx_buffer->skb) {
> struct sk_buff *skb = rx_buffer->skb;
>
> - if (WX_CB(skb)->page_released)
> - page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
> -
> dev_kfree_skb(skb);
> }
>
I think the page_released member of wx_cb.
It seems to be unused now.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net 2/3] net: libwx: fix the using of Rx buffer DMA
2025-07-09 6:40 [PATCH net 0/3] Fix Rx fatal errors Jiawen Wu
2025-07-09 6:40 ` [PATCH net 1/3] net: libwx: remove duplicate page_pool_put_full_page() Jiawen Wu
@ 2025-07-09 6:40 ` Jiawen Wu
2025-07-09 11:43 ` Simon Horman
2025-07-09 6:40 ` [PATCH net 3/3] net: libwx: properly reset Rx ring descriptor Jiawen Wu
2 siblings, 1 reply; 7+ messages in thread
From: Jiawen Wu @ 2025-07-09 6:40 UTC (permalink / raw)
To: netdev, andrew+netdev, davem, edumazet, kuba, pabeni, horms,
michal.kubiak
Cc: mengyuanlou, duanqiangwen, Jiawen Wu, stable
The wx_rx_buffer structure contained two DMA address fields: 'dma' and
'page_dma'. However, only 'page_dma' was actually initialized and used
to program the Rx descriptor. But 'dma' was uninitialized and used in
some paths.
This could lead to undefined behavior, including DMA errors or
use-after-free, if the uninitialized 'dma' was used. Althrough such
error has not yet occurred, it is worth fixing in the code.
Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
---
drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 ++--
drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 -
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
index 7e3d7fb61a52..c91487909811 100644
--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
@@ -307,7 +307,7 @@ static bool wx_alloc_mapped_page(struct wx_ring *rx_ring,
return false;
dma = page_pool_get_dma_addr(page);
- bi->page_dma = dma;
+ bi->dma = dma;
bi->page = page;
bi->page_offset = 0;
@@ -344,7 +344,7 @@ void wx_alloc_rx_buffers(struct wx_ring *rx_ring, u16 cleaned_count)
DMA_FROM_DEVICE);
rx_desc->read.pkt_addr =
- cpu_to_le64(bi->page_dma + bi->page_offset);
+ cpu_to_le64(bi->dma + bi->page_offset);
rx_desc++;
bi++;
diff --git a/drivers/net/ethernet/wangxun/libwx/wx_type.h b/drivers/net/ethernet/wangxun/libwx/wx_type.h
index c363379126c0..f5a8ce681a68 100644
--- a/drivers/net/ethernet/wangxun/libwx/wx_type.h
+++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h
@@ -998,7 +998,6 @@ struct wx_tx_buffer {
struct wx_rx_buffer {
struct sk_buff *skb;
dma_addr_t dma;
- dma_addr_t page_dma;
struct page *page;
unsigned int page_offset;
};
--
2.48.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH net 2/3] net: libwx: fix the using of Rx buffer DMA
2025-07-09 6:40 ` [PATCH net 2/3] net: libwx: fix the using of Rx buffer DMA Jiawen Wu
@ 2025-07-09 11:43 ` Simon Horman
0 siblings, 0 replies; 7+ messages in thread
From: Simon Horman @ 2025-07-09 11:43 UTC (permalink / raw)
To: Jiawen Wu
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
michal.kubiak, mengyuanlou, duanqiangwen, stable
On Wed, Jul 09, 2025 at 02:40:24PM +0800, Jiawen Wu wrote:
> The wx_rx_buffer structure contained two DMA address fields: 'dma' and
> 'page_dma'. However, only 'page_dma' was actually initialized and used
> to program the Rx descriptor. But 'dma' was uninitialized and used in
> some paths.
>
> This could lead to undefined behavior, including DMA errors or
> use-after-free, if the uninitialized 'dma' was used. Althrough such
> error has not yet occurred, it is worth fixing in the code.
>
> Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net 3/3] net: libwx: properly reset Rx ring descriptor
2025-07-09 6:40 [PATCH net 0/3] Fix Rx fatal errors Jiawen Wu
2025-07-09 6:40 ` [PATCH net 1/3] net: libwx: remove duplicate page_pool_put_full_page() Jiawen Wu
2025-07-09 6:40 ` [PATCH net 2/3] net: libwx: fix the using of Rx buffer DMA Jiawen Wu
@ 2025-07-09 6:40 ` Jiawen Wu
2025-07-09 11:43 ` Simon Horman
2 siblings, 1 reply; 7+ messages in thread
From: Jiawen Wu @ 2025-07-09 6:40 UTC (permalink / raw)
To: netdev, andrew+netdev, davem, edumazet, kuba, pabeni, horms,
michal.kubiak
Cc: mengyuanlou, duanqiangwen, Jiawen Wu, stable
When device reset is triggered by feature changes such as toggling Rx
VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The
hardware descriptor ring may retain stale values from previous sessions.
And only set the length to 0 in rx_desc[0] would result in building
malformed SKBs. Fix it to ensure a clean slate after device reset.
[ 549.186435] [ C16] ------------[ cut here ]------------
[ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814!
[ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary)
[ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024
[ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510
[ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8
[ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282
[ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2
[ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40
[ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e
[ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200
[ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2
[ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000
[ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0
[ 549.186505] [ C16] PKRU: 55555554
[ 549.186507] [ C16] Call Trace:
[ 549.186510] [ C16] <IRQ>
[ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
[ 549.186517] [ C16] __skb_pad+0xc7/0xf0
[ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx]
[ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx]
[ 549.186540] [ C16] __napi_poll+0x28/0x190
[ 549.186544] [ C16] net_rx_action+0x301/0x3f0
[ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
[ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50
[ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
[ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160
[ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
[ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0
[ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130
[ 549.186572] [ C16] common_interrupt+0xb8/0xd0
[ 549.186576] [ C16] </IRQ>
[ 549.186577] [ C16] <TASK>
[ 549.186579] [ C16] asm_common_interrupt+0x22/0x40
[ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420
[ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d
[ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246
[ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000
[ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3
[ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000
[ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40
[ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000
[ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420
[ 549.186605] [ C16] cpuidle_enter+0x29/0x40
[ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170
[ 549.186613] [ C16] do_idle+0x7a/0xc0
[ 549.186616] [ C16] cpu_startup_entry+0x25/0x30
[ 549.186618] [ C16] start_secondary+0x117/0x140
[ 549.186623] [ C16] common_startup_64+0x13e/0x148
[ 549.186628] [ C16] </TASK>
Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
---
drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +++----
drivers/net/ethernet/wangxun/libwx/wx_lib.c | 5 +++++
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c
index a9519997286b..9002b97e148e 100644
--- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c
+++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c
@@ -1912,7 +1912,6 @@ static void wx_configure_rx_ring(struct wx *wx,
struct wx_ring *ring)
{
u16 reg_idx = ring->reg_idx;
- union wx_rx_desc *rx_desc;
u64 rdba = ring->dma;
u32 rxdctl;
@@ -1942,9 +1941,9 @@ static void wx_configure_rx_ring(struct wx *wx,
memset(ring->rx_buffer_info, 0,
sizeof(struct wx_rx_buffer) * ring->count);
- /* initialize Rx descriptor 0 */
- rx_desc = WX_RX_DESC(ring, 0);
- rx_desc->wb.upper.length = 0;
+ /* reset ntu and ntc to place SW in sync with hardwdare */
+ ring->next_to_clean = 0;
+ ring->next_to_use = 0;
/* enable receive descriptor ring */
wr32m(wx, WX_PX_RR_CFG(reg_idx),
diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
index c91487909811..0213ad5a6ceb 100644
--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
@@ -357,6 +357,8 @@ void wx_alloc_rx_buffers(struct wx_ring *rx_ring, u16 cleaned_count)
/* clear the status bits for the next_to_use descriptor */
rx_desc->wb.upper.status_error = 0;
+ /* clear the length for the next_to_use descriptor */
+ rx_desc->wb.upper.length = 0;
cleaned_count--;
} while (cleaned_count);
@@ -2438,6 +2440,9 @@ static void wx_clean_rx_ring(struct wx_ring *rx_ring)
}
}
+ /* Zero out the descriptor ring */
+ memset(rx_ring->desc, 0, rx_ring->size);
+
rx_ring->next_to_alloc = 0;
rx_ring->next_to_clean = 0;
rx_ring->next_to_use = 0;
--
2.48.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH net 3/3] net: libwx: properly reset Rx ring descriptor
2025-07-09 6:40 ` [PATCH net 3/3] net: libwx: properly reset Rx ring descriptor Jiawen Wu
@ 2025-07-09 11:43 ` Simon Horman
0 siblings, 0 replies; 7+ messages in thread
From: Simon Horman @ 2025-07-09 11:43 UTC (permalink / raw)
To: Jiawen Wu
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
michal.kubiak, mengyuanlou, duanqiangwen, stable
On Wed, Jul 09, 2025 at 02:40:25PM +0800, Jiawen Wu wrote:
> When device reset is triggered by feature changes such as toggling Rx
> VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The
> hardware descriptor ring may retain stale values from previous sessions.
> And only set the length to 0 in rx_desc[0] would result in building
> malformed SKBs. Fix it to ensure a clean slate after device reset.
>
> [ 549.186435] [ C16] ------------[ cut here ]------------
> [ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814!
> [ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI
> [ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary)
> [ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024
> [ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510
> [ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8
> [ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282
> [ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2
> [ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40
> [ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e
> [ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200
> [ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2
> [ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000
> [ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0
> [ 549.186505] [ C16] PKRU: 55555554
> [ 549.186507] [ C16] Call Trace:
> [ 549.186510] [ C16] <IRQ>
> [ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 549.186517] [ C16] __skb_pad+0xc7/0xf0
> [ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx]
> [ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx]
> [ 549.186540] [ C16] __napi_poll+0x28/0x190
> [ 549.186544] [ C16] net_rx_action+0x301/0x3f0
> [ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50
> [ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160
> [ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0
> [ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130
> [ 549.186572] [ C16] common_interrupt+0xb8/0xd0
> [ 549.186576] [ C16] </IRQ>
> [ 549.186577] [ C16] <TASK>
> [ 549.186579] [ C16] asm_common_interrupt+0x22/0x40
> [ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420
> [ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d
> [ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246
> [ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000
> [ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3
> [ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000
> [ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40
> [ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000
> [ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420
> [ 549.186605] [ C16] cpuidle_enter+0x29/0x40
> [ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170
> [ 549.186613] [ C16] do_idle+0x7a/0xc0
> [ 549.186616] [ C16] cpu_startup_entry+0x25/0x30
> [ 549.186618] [ C16] start_secondary+0x117/0x140
> [ 549.186623] [ C16] common_startup_64+0x13e/0x148
> [ 549.186628] [ C16] </TASK>
>
> Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Reviewed-by: Simon Horman <horms@kernel.org>
> diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c
...
> @@ -1942,9 +1941,9 @@ static void wx_configure_rx_ring(struct wx *wx,
> memset(ring->rx_buffer_info, 0,
> sizeof(struct wx_rx_buffer) * ring->count);
>
> - /* initialize Rx descriptor 0 */
> - rx_desc = WX_RX_DESC(ring, 0);
> - rx_desc->wb.upper.length = 0;
> + /* reset ntu and ntc to place SW in sync with hardwdare */
nit: hardware
...
^ permalink raw reply [flat|nested] 7+ messages in thread