[PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[Liu Chao]

t7xx_dpmaif_release_tx_buffer() iterates release_cnt times over the
TX ring, advancing cur_idx and updating txq->drb_release_rd_idx on
each iteration. When a PD DRB has no associated skb, the loop hits
the "invalid skb" error path and does a bare continue, skipping the
ring index advance and the budget notification.

The loop counter i still increments, so the function returns a
release count that does not match the number of DRBs actually
consumed from the ring. The caller t7xx_dpmaif_tx_release() then
compares real_rel_cnt against rel_cnt and may keep returning
-EAGAIN, causing the TX reclaim path to spin without making forward
progress on the stuck entry.

Advance the ring index and update drb_release_rd_idx before
continuing, so every iteration consumes exactly one DRB and the
returned count stays consistent with the ring state.

Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c
index 8dab025a0..a51bad54d 100644
--- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c
+++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c
@@ -103,16 +103,15 @@ static unsigned int t7xx_dpmaif_release_tx_buffer(struct dpmaif_ctrl *dpmaif_ctr
 				dma_unmap_single(dpmaif_ctrl->dev, cur_drb_skb->bus_addr,
 						 cur_drb_skb->data_len, DMA_TO_DEVICE);
 
-			if (!FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header))) {
-				if (!cur_drb_skb->skb) {
-					dev_err(dpmaif_ctrl->dev,
-						"txq%u: DRB check fail, invalid skb\n", q_num);
-					continue;
+				if (!FIELD_GET(DRB_HDR_CONT, le32_to_cpu(cur_drb->header))) {
+					if (!cur_drb_skb->skb) {
+						dev_err(dpmaif_ctrl->dev,
+							"txq%u: DRB check fail, invalid skb\n", q_num);
+					} else {
+						dev_kfree_skb_any(cur_drb_skb->skb);
+					}
 				}
 
-				dev_kfree_skb_any(cur_drb_skb->skb);
-			}
-
 			cur_drb_skb->skb = NULL;
 		}
 
-- 
2.50.1

Re: [PATCH] net: wwan: t7xx: fix tx buffer release loop on invalid skb

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.