[PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[Denis Arefev]

unmap_partial_tx_skb() walks the TX ring entries between first_entry
and entry to release the DMA mappings of the fragments that were
mapped successfully before a mapping error, but it never advances
first_entry inside the loop. Whenever the failed fragment is not
the first one, entry is ahead of first_entry and the loop condition
first_entry != entry never becomes false, so the function spins
forever.

The function is called from happy_meal_start_xmit() with
hp->happy_lock held and interrupts disabled, so the infinite loop
leads to a hard lockup.

Now that the loop lockup is fixed, a secondary bug becomes reachable:
the function unmaps the pages but leaves the descriptors in the ring
with the TXFLAG_OWN bit still set. When the driver subsequently
processes a new linear packet, the hardware MAC will advance into these
stale descriptors, causing IOMMU faults, TX ring desynchronization.

Fix both issues by advancing the entry pointer using NEXT_TX() at the
end of the loop, and clearing each descriptor via hme_write_txd()
immediately after performing the DMA unmap.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: ec1f1276022e ("sunhme: Add DMA mapping error checks.")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
Changes since v1:
- Also clear the stale TX descriptors (hme_write_txd(hp, this, 0,0)) after unmapping them.
v1: https://lore.kernel.org/all/20261013103228.37430-1-arefev@swemel.ru/
---
 Compile tested only
 drivers/net/ethernet/sun/sunhme.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index a70f704eb9f3..dace94841a6f 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1965,6 +1965,8 @@ static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping,
 		len = hme_read_desc32(hp, &this->tx_flags);
 		len &= TXFLAG_SIZE;
 		dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE);
+		hme_write_txd(hp, this, 0, 0);
+		first_entry = NEXT_TX(first_entry);
 	}
 }
 
-- 
2.43.0

Re: [PATCH net v2] net: sunhme: fix infinite loop in unmap_partial_tx_skb()

[Jakub Kicinski]

On Thu, 15 Oct 2026 14:43:54 +0300 Denis Arefev wrote:
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

We don't take LLM fixes for ancient HW drivers
-- 
pw-bot: reject