[PATCH 0/3] stmmac crash/stall fixes when under memory pressure

[Sam Edwards <cfsworks@gmail.com>]

Hi netdev maintainers,

This is a pair of bugfixes for the stmmac driver's receive pipeline. These
issues occur when stmmac_rx_refill() does not (fully) succeed, which happens
more frequently when free memory is low.

The first patch closes Bugzilla bug #221010, where stmmac_rx() can circle
around to a still-dirty descriptor (with a NULL buffer pointer), mistake it for
a filled descriptor (due to OWN=0), and attempt to dereference the buffer.

In testing that patch, I discovered a second issue: starvation of available RX
buffers causes the NIC to stop sending interrupts; if the driver stops polling,
it will wait indefinitely for an interrupt that will never come. (Note: the
first patch makes this issue more prominent -- mostly because it lets the
system survive long enough to exhibit it -- but doesn't *cause* it.) The second
patch addresses that problem as well.

The first two patches are minimal and intended for stable. The third is a
general cleanup that removes the `limit` clamp and *solves* the issue of the
loop mistaking dirty entries for filled ones, rather than *avoiding* it.
Because this final patch changes the range of stmmac_rx_dirty()'s possible
return values, it's intended for -next, not stable.

I look forward to your feedback,
Sam

Sam Edwards (3):
  net: stmmac: Fix NULL deref when RX encounters a dirty descriptor
  net: stmmac: Prevent indefinite RX stall on buffer exhaustion
  net: stmmac: Remove stmmac_rx()'s `limit`, check desc validity instead

 .../net/ethernet/stmicro/stmmac/stmmac_main.c    | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

-- 
2.52.0