shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity

net: broadcom: bcm4908_enet: update TX stats after actual transmission

Browse Source 
Queueing packets doesn't guarantee their transmission. Update TX stats
after hardware confirms consuming submitted data.

This also fixes a possible race and NULL dereference.
bcm4908_enet_start_xmit() could try to access skb after freeing it in
the bcm4908_enet_poll_tx().

Reported-by: Florian Fainelli <f.fainelli@gmail.com>
Fixes: 4feffeadbc ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Rafał Miłecki
2022-10-27 13:24:30 +02:00
committed by Jakub Kicinski
parent bc520f5e25
commit ef3556ee16
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/ethernet/broadcom/bcm4908_enet.c
View File

@@ -561,8 +561,6 @@ static netdev_tx_t bcm4908_enet_start_xmit(struct sk_buff *skb, struct net_devic
if (++ring->write_idx == ring->length - 1) if (++ring->write_idx == ring->length - 1)
ring->write_idx = 0; ring->write_idx = 0;
enet->netdev->stats.tx_bytes += skb->len;
enet->netdev->stats.tx_packets++;
return NETDEV_TX_OK; return NETDEV_TX_OK;
} }
@@ -635,6 +633,7 @@ static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight)
struct bcm4908_enet_dma_ring_bd *buf_desc; struct bcm4908_enet_dma_ring_bd *buf_desc;
struct bcm4908_enet_dma_ring_slot *slot; struct bcm4908_enet_dma_ring_slot *slot;
struct device *dev = enet->dev; struct device *dev = enet->dev;
unsigned int bytes = 0;
int handled = 0; int handled = 0;
while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) { while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
@@ -645,12 +644,17 @@ static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight)
dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE); dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
dev_kfree_skb(slot->skb); dev_kfree_skb(slot->skb);
if (++tx_ring->read_idx == tx_ring->length)
tx_ring->read_idx = 0;
handled++; handled++;
bytes += slot->len;
if (++tx_ring->read_idx == tx_ring->length)
tx_ring->read_idx = 0;
} }
enet->netdev->stats.tx_packets += handled;
enet->netdev->stats.tx_bytes += bytes;
if (handled < weight) { if (handled < weight) {
napi_complete_done(napi, handled); napi_complete_done(napi, handled);
bcm4908_enet_dma_ring_intrs_on(enet, tx_ring); bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);