Re: [PATCH net 1/2] net: bcmgenet: fix leaking free_bds

Justin Chen
2026-03-31T23:11:56Z

On 3/27/26 9:11 PM, Jakub Kicinski wrote:
> On Thu, 26 Mar 2026 11:45:28 -0700 justin.chen@broadcom.com wrote:
>> From: Justin Chen <justin.chen@broadcom.com>
>>
>> While reclaiming the tx queue we fast forward the write pointer to
>> drop any data in flight. These dropped frames are not added back
>> to the pool of free bds. We also need to tell the netdev that we
>> are dropping said data.
>
>> diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
>> index 482a31e7b72b..3e1fc3bb8297 100644
>> --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
>> +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
>> @@ -1985,6 +1985,7 @@ static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
>> drop = (ring->prod_index - ring->c_index) & DMA_C_INDEX_MASK;
>> released += drop;
>> ring->prod_index = ring->c_index & DMA_C_INDEX_MASK;
>> + ring->free_bds += drop;
>> while (drop--) {
>> cb_ptr = bcmgenet_put_txcb(priv, ring);
>> skb = cb_ptr->skb;
>> @@ -1996,6 +1997,7 @@ static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
>> }
>> if (skb)
>> dev_consume_skb_any(skb);
>> + netdev_tx_reset_queue(netdev_get_tx_queue(dev, ring->index));
>> bcmgenet_tdma_ring_writel(priv, ring->index,
>> ring->prod_index, TDMA_PROD_INDEX);
>> wr_ptr = ring->write_ptr * WORDS_PER_BD(priv);
>
> AI says you may be off by one here?
>
> Does this loop miss the oldest dropped descriptor and leak its SKB and
> DMA mapping?
>
> Since bcmgenet_get_txcb() increments write_ptr after a transmission,
> write_ptr always points to the next available empty slot.
>
> When this loops backwards drop times, the first iteration retrieves that
> empty descriptor (where cb->skb is NULL), and the loop will finish before
> reaching the oldest uncompleted descriptor at c_index.
>
> When write_ptr is rolled back to c_index, won't subsequent transmissions
> overwrite the descriptor at c_index and permanently leak the unmapped DMA
> buffer and SKB memory?

Ack. Looks like this is another bug. Yes, it causes an off-by-one in
this case, but also in the xmit error path case. So I think this
warrants another commit. Will submit v3 with this as another bug fix.

Thanks,
Justin