target/linux/bcm4908/patches-5.10/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch

   1 From ef3556ee16c68735ec69bd08df41d1cd83b14ad3 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
   3 Date: Thu, 27 Oct 2022 13:24:30 +0200
   4 Subject: [PATCH] net: broadcom: bcm4908_enet: update TX stats after actual
   5  transmission
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 Queueing packets doesn't guarantee their transmission. Update TX stats
  11 after hardware confirms consuming submitted data.
  12
  13 This also fixes a possible race and NULL dereference.
  14 bcm4908_enet_start_xmit() could try to access skb after freeing it in
  15 the bcm4908_enet_poll_tx().
  16
  17 Reported-by: Florian Fainelli <f.fainelli@gmail.com>
  18 Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
  19 Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  20 Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
  21 Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com
  22 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  23 ---
  24  drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++----
  25  1 file changed, 8 insertions(+), 4 deletions(-)
  26
  27 --- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
  28 +++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
  29 @@ -560,8 +560,6 @@ static int bcm4908_enet_start_xmit(struc
  30
  31         if (++ring->write_idx == ring->length - 1)
  32                 ring->write_idx = 0;
  33 -       enet->netdev->stats.tx_bytes += skb->len;
  34 -       enet->netdev->stats.tx_packets++;
  35
  36         return NETDEV_TX_OK;
  37  }
  38 @@ -634,6 +632,7 @@ static int bcm4908_enet_poll_tx(struct n
  39         struct bcm4908_enet_dma_ring_bd *buf_desc;
  40         struct bcm4908_enet_dma_ring_slot *slot;
  41         struct device *dev = enet->dev;
  42 +       unsigned int bytes = 0;
  43         int handled = 0;
  44
  45         while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
  46 @@ -644,12 +643,17 @@ static int bcm4908_enet_poll_tx(struct n
  47
  48                 dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
  49                 dev_kfree_skb(slot->skb);
  50 -               if (++tx_ring->read_idx == tx_ring->length)
  51 -                       tx_ring->read_idx = 0;
  52
  53                 handled++;
  54 +               bytes += slot->len;
  55 +
  56 +               if (++tx_ring->read_idx == tx_ring->length)
  57 +                       tx_ring->read_idx = 0;
  58         }
  59
  60 +       enet->netdev->stats.tx_packets += handled;
  61 +       enet->netdev->stats.tx_bytes += bytes;
  62 +
  63         if (handled < weight) {
  64                 napi_complete_done(napi, handled);
  65                 bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);