[PATCH] net: cxgb4: do not leak a PTP skb when the Tx queue is busy

[PATCH] net: cxgb4: do not leak a PTP skb when the Tx queue is busy

[Wentao Liang]

cxgb4_eth_xmit() stores the PTP skb in adap->ptp_tx_skb with an extra
reference before the descriptor credits are checked.  When the PTP
queue is full the function returns NETDEV_TX_BUSY, and later failures
such as an unsupported FCoE offload or a failed DMA mapping jump to
out_free.  None of those paths transmit the packet, so no transmit
timestamp ever arrives and the extra reference is never released.

Only take the extra reference once the packet is certain to be queued,
just before it is handed to the hardware.  The initial check for an
outstanding PTP skb is kept, and PTP transmits are serialized by
adap->ptp_lock, so only one PTP packet can be in flight.

Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/chelsio/cxgb4/sge.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 9fccb8ea9bcd..7e83f60bd14e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -1523,12 +1523,9 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	qidx = skb_get_queue_mapping(skb);
 	if (ptp_enabled) {
-		if (!(adap->ptp_tx_skb)) {
-			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
-			adap->ptp_tx_skb = skb_get(skb);
-		} else {
+		if (adap->ptp_tx_skb)
 			goto out_free;
-		}
+		skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
 		q = &adap->sge.ptptxq;
 	} else {
 		q = &adap->sge.ethtxq[qidx + pi->first_qset];
@@ -1707,6 +1704,9 @@ static netdev_tx_t cxgb4_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	skb_tx_timestamp(skb);
 
+	if (ptp_enabled)
+		adap->ptp_tx_skb = skb_get(skb);
+
 	if (immediate) {
 		cxgb4_inline_tx_skb(skb, &q->q, sgl);
 		dev_consume_skb_any(skb);
-- 
2.34.1

Re: [PATCH] net: cxgb4: do not leak a PTP skb when the Tx queue is busy

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net: cxgb4: do not leak a PTP skb when the Tx queue is busy

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:05:30 +0000, Wentao Liang wrote:
> cxgb4_eth_xmit() stores the PTP skb in adap->ptp_tx_skb with an extra
> reference before the descriptor credits are checked.  When the PTP
> queue is full the function returns NETDEV_TX_BUSY, and later failures
> such as an unsupported FCoE offload or a failed DMA mapping jump to
> out_free.  None of those paths transmit the packet, so no transmit
> timestamp ever arrives and the extra reference is never released.
> 
> Only take the extra reference once the packet is certain to be queued,
> just before it is handed to the hardware.  The initial check for an
> outstanding PTP skb is kept, and PTP transmits are serialized by
> adap->ptp_lock, so only one PTP packet can be in flight.
> 
> Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/chelsio/cxgb4/sge.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof