Re: [PATCH net 1/2] net: bcmgenet: fix leaking free_bds

[Justin Chen <justin.chen@broadcom.com>]

On 3/27/26 9:11 PM, Jakub Kicinski wrote:
> On Thu, 26 Mar 2026 11:45:28 -0700 justin.chen@broadcom.com wrote:
>> From: Justin Chen <justin.chen@broadcom.com>
>>
>> While reclaiming the tx queue we fast forward the write pointer to
>> drop any data in flight. These dropped frames are not added back
>> to the pool of free bds. We also need to tell the netdev that we
>> are dropping said data.
> 
>> diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
>> index 482a31e7b72b..3e1fc3bb8297 100644
>> --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
>> +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
>> @@ -1985,6 +1985,7 @@ static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
>>   		drop = (ring->prod_index - ring->c_index) & DMA_C_INDEX_MASK;
>>   		released += drop;
>>   		ring->prod_index = ring->c_index & DMA_C_INDEX_MASK;
>> +		ring->free_bds += drop;
>>   		while (drop--) {
>>   			cb_ptr = bcmgenet_put_txcb(priv, ring);
>>   			skb = cb_ptr->skb;
>> @@ -1996,6 +1997,7 @@ static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
>>   		}
>>   		if (skb)
>>   			dev_consume_skb_any(skb);
>> +		netdev_tx_reset_queue(netdev_get_tx_queue(dev, ring->index));
>>   		bcmgenet_tdma_ring_writel(priv, ring->index,
>>   					  ring->prod_index, TDMA_PROD_INDEX);
>>   		wr_ptr = ring->write_ptr * WORDS_PER_BD(priv);
> 
> AI says you may be off by one here?
> 
>    Does this loop miss the oldest dropped descriptor and leak its SKB and
>    DMA mapping?
> 
>    Since bcmgenet_get_txcb() increments write_ptr after a transmission,
>    write_ptr always points to the next available empty slot.
> 
>    When this loops backwards drop times, the first iteration retrieves that
>    empty descriptor (where cb->skb is NULL), and the loop will finish before
>    reaching the oldest uncompleted descriptor at c_index.
> 
>    When write_ptr is rolled back to c_index, won't subsequent transmissions
>    overwrite the descriptor at c_index and permanently leak the unmapped DMA
>    buffer and SKB memory?

Ack. Looks like this is another bug. Yes, it causes an off-by-one in 
this case, but also in the xmit error path case. So I think this 
warrants another commit. Will submit v3 with this as another bug fix.

Thanks,
Justin