[PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[Liu Chao]

t7xx_dpmaif_release_tx_buffer() iterates release_cnt times over the
TX ring, advancing cur_idx and updating txq->drb_release_rd_idx on
each iteration. When a PD DRB has no associated skb, the loop hits
the "invalid skb" error path and does a bare continue, skipping the
ring index advance and the budget notification.

The loop counter i still increments, so the function returns a
release count that does not match the number of DRBs actually
consumed from the ring. The caller t7xx_dpmaif_tx_release() then
compares real_rel_cnt against rel_cnt and may keep returning
-EAGAIN, causing the TX reclaim path to spin without making forward
progress on the stuck entry.

Advance the ring index and update drb_release_rd_idx before
continuing, so every iteration consumes exactly one DRB and the
returned count stays consistent with the ring state.

Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c
index 8dab025a0..a51bad54d 100644
--- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c
+++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c
@@ -103,16 +103,15 @@ static unsigned int t7xx_dpmaif_release_tx_buffer(struct dpmaif_ctrl *dpmaif_ctr
 				dma_unmap_single(dpmaif_ctrl->dev, cur_drb_skb->bus_addr,
 						 cur_drb_skb->data_len, DMA_TO_DEVICE);
 
-			if (!FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header))) {
-				if (!cur_drb_skb->skb) {
-					dev_err(dpmaif_ctrl->dev,
-						"txq%u: DRB check fail, invalid skb\n", q_num);
-					continue;
+				if (!FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header))) {
+					if (!cur_drb_skb->skb) {
+						dev_err(dpmaif_ctrl->dev,
+							"txq%u: DRB check fail, invalid skb\n", q_num);
+					} else {
+						dev_kfree_skb_any(cur_drb_skb->skb);
+					}
 				}
 
-				dev_kfree_skb_any(cur_drb_skb->skb);
-			}
-
 			cur_drb_skb->skb = NULL;
 		}
 
-- 
2.50.1

Re: [PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[kernel test robot]

Hi Liu,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]
[also build test WARNING on net/main wireless-next/main wireless/main linus/master v7.3-rc7 next-20261016]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Liu-Chao/net-wwan-t7xx-fix-tx-buffer-release-loop-on-invalid-skb/20261016-121156
base:   net-next/main
patch link:    https://lore.kernel.org/r/20261016041156.2295670-1-liuc63%40xiaopeng.com
patch subject: [PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20261017/202610170128.gs8DZ6Gj-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261017/202610170128.gs8DZ6Gj-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610170128.gs8DZ6Gj-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c: In function 't7xx_dpmaif_release_tx_buffer':
>> drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c:102:25: warning: this 'if' clause does not guard... [-Wmisleading-indentation]
     102 |                         if (!cur_drb_skb->is_msg)
         |                         ^~
   drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c:106:33: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
     106 |                                 if (!FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header))) {
         |                                 ^~


vim +/if +102 drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c

d642b012df70a76 Haijun Liu 2022-05-06   79  
d642b012df70a76 Haijun Liu 2022-05-06   80  static unsigned int t7xx_dpmaif_release_tx_buffer(struct dpmaif_ctrl *dpmaif_ctrl,
d642b012df70a76 Haijun Liu 2022-05-06   81  						  unsigned int q_num, unsigned int release_cnt)
d642b012df70a76 Haijun Liu 2022-05-06   82  {
d642b012df70a76 Haijun Liu 2022-05-06   83  	struct dpmaif_tx_queue *txq = &dpmaif_ctrl->txq[q_num];
d642b012df70a76 Haijun Liu 2022-05-06   84  	struct dpmaif_callbacks *cb = dpmaif_ctrl->callbacks;
d642b012df70a76 Haijun Liu 2022-05-06   85  	struct dpmaif_drb_skb *cur_drb_skb, *drb_skb_base;
d642b012df70a76 Haijun Liu 2022-05-06   86  	struct dpmaif_drb *cur_drb, *drb_base;
d642b012df70a76 Haijun Liu 2022-05-06   87  	unsigned int drb_cnt, i, cur_idx;
d642b012df70a76 Haijun Liu 2022-05-06   88  	unsigned long flags;
d642b012df70a76 Haijun Liu 2022-05-06   89  
d642b012df70a76 Haijun Liu 2022-05-06   90  	drb_skb_base = txq->drb_skb_base;
d642b012df70a76 Haijun Liu 2022-05-06   91  	drb_base = txq->drb_base;
d642b012df70a76 Haijun Liu 2022-05-06   92  
d642b012df70a76 Haijun Liu 2022-05-06   93  	spin_lock_irqsave(&txq->tx_lock, flags);
d642b012df70a76 Haijun Liu 2022-05-06   94  	drb_cnt = txq->drb_size_cnt;
d642b012df70a76 Haijun Liu 2022-05-06   95  	cur_idx = txq->drb_release_rd_idx;
d642b012df70a76 Haijun Liu 2022-05-06   96  	spin_unlock_irqrestore(&txq->tx_lock, flags);
d642b012df70a76 Haijun Liu 2022-05-06   97  
d642b012df70a76 Haijun Liu 2022-05-06   98  	for (i = 0; i < release_cnt; i++) {
d642b012df70a76 Haijun Liu 2022-05-06   99  		cur_drb = drb_base + cur_idx;
d642b012df70a76 Haijun Liu 2022-05-06  100  		if (FIELD_GET(DRB_HDR_DTYP, le32_to_cpu(cur_drb->header)) == DES_DTYP_PD) {
d642b012df70a76 Haijun Liu 2022-05-06  101  			cur_drb_skb = drb_skb_base + cur_idx;
d642b012df70a76 Haijun Liu 2022-05-06 @102  			if (!cur_drb_skb->is_msg)
d642b012df70a76 Haijun Liu 2022-05-06  103  				dma_unmap_single(dpmaif_ctrl->dev, cur_drb_skb->bus_addr,
d642b012df70a76 Haijun Liu 2022-05-06  104  						 cur_drb_skb->data_len, DMA_TO_DEVICE);
d642b012df70a76 Haijun Liu 2022-05-06  105  
d642b012df70a76 Haijun Liu 2022-05-06  106  				if (!FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header))) {
d642b012df70a76 Haijun Liu 2022-05-06  107  					if (!cur_drb_skb->skb) {
d642b012df70a76 Haijun Liu 2022-05-06  108  						dev_err(dpmaif_ctrl->dev,
d642b012df70a76 Haijun Liu 2022-05-06  109  							"txq%u: DRB check fail, invalid skb\n", q_num);
35baede15130184 Liu Chao   2026-10-16  110  					} else {
d642b012df70a76 Haijun Liu 2022-05-06  111  						dev_kfree_skb_any(cur_drb_skb->skb);
d642b012df70a76 Haijun Liu 2022-05-06  112  					}
35baede15130184 Liu Chao   2026-10-16  113  				}
d642b012df70a76 Haijun Liu 2022-05-06  114  
d642b012df70a76 Haijun Liu 2022-05-06  115  			cur_drb_skb->skb = NULL;
d642b012df70a76 Haijun Liu 2022-05-06  116  		}
d642b012df70a76 Haijun Liu 2022-05-06  117  
d642b012df70a76 Haijun Liu 2022-05-06  118  		spin_lock_irqsave(&txq->tx_lock, flags);
d642b012df70a76 Haijun Liu 2022-05-06  119  		cur_idx = t7xx_ring_buf_get_next_wr_idx(drb_cnt, cur_idx);
d642b012df70a76 Haijun Liu 2022-05-06  120  		txq->drb_release_rd_idx = cur_idx;
d642b012df70a76 Haijun Liu 2022-05-06  121  		spin_unlock_irqrestore(&txq->tx_lock, flags);
d642b012df70a76 Haijun Liu 2022-05-06  122  
d642b012df70a76 Haijun Liu 2022-05-06  123  		if (atomic_inc_return(&txq->tx_budget) > txq->drb_size_cnt / 8)
d642b012df70a76 Haijun Liu 2022-05-06  124  			cb->state_notify(dpmaif_ctrl->t7xx_dev, DMPAIF_TXQ_STATE_IRQ, txq->index);
d642b012df70a76 Haijun Liu 2022-05-06  125  	}
d642b012df70a76 Haijun Liu 2022-05-06  126  
d642b012df70a76 Haijun Liu 2022-05-06  127  	if (FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header)))
d642b012df70a76 Haijun Liu 2022-05-06  128  		dev_err(dpmaif_ctrl->dev, "txq%u: DRB not marked as the last one\n", q_num);
d642b012df70a76 Haijun Liu 2022-05-06  129  
d642b012df70a76 Haijun Liu 2022-05-06  130  	return i;
d642b012df70a76 Haijun Liu 2022-05-06  131  }
d642b012df70a76 Haijun Liu 2022-05-06  132  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki