Re: [PATCH net] net: gianfar: clear the pending Rx skb when freeing the Rx ring

[Anthony Pighin <anthony.pighin@nokia.com>]

> - How the issue was discovered, e.g. hit in production, hit during
>   development, syzbot report, manual code inspection, LLM or static
>   analysis tool scan.

Hit during development, as intermittent kernel panics in our automated
regression on an NXP LS1021A board (eTSEC), in an L2 Ethernet traffic
test that shuts and re-enables ports. It was seen on 6.6, 6.12 and
6.18 based kernels, crashing in unrelated places such as
kmem_cache_alloc() called from build_skb() in gfar_poll_rx_sq().

> - Whether the issue was actually triggered, or is only theoretical
>   (e.g. found by LLM and not proven at runtime). If it was triggered
>   please include the symptoms, like the stack trace or kernel messages.

Triggered and reproduced. Bouncing an eTSEC port while a traffic
generator sends 9000 byte frames into it at line rate, an unpatched
6.18.62 based kernel panicked within 50 bounces. A temporary WARN in
free_skb_rx_queue() showed a pending skb being freed on nearly every
bounce. The bad PTE values below look like packet contents:

  BUG: Bad page map in process udevd  pte:c40cffffffffffff
  BUG: Bad page map in process udevd  pte:450008c193dd7a
  BUG: Bad page map in process udevd  pte:1140000000004801
  Internal error: : 221 [#1] SMP ARM
  PC is at folio_remove_rmap_ptes+0x3c/0x118
  LR is at unmap_page_range+0x5ec/0xde0
  Kernel panic - not syncing: Fatal exception

With slub_debug=FZU it panicked on the second bounce, in usbnet's
rx_complete() using an skb that SLUB reports as free, last allocated
by gianfar and then freed by the IPv6 stack. That is, the stale free
had released usbnet's skb while usbnet still owned it:

  Unable to handle kernel paging request at virtual address 00040035 when read
  PC is at rx_complete+0x260/0x37c
  Register r6 information: slab skbuff_head_cache start c1e86dc0 data offset 64 pointer offset 0 size 184 allocated at build_skb+0x30/0xac
      build_skb+0x30/0xac
      gfar_poll_rx_sq+0x19c/0x7f0
   Free path:
      kmem_cache_free+0x284/0x438
      kfree_skbmem+0xac/0xb0
      sk_skb_reason_drop+0x68/0x134
      ip6_rcv_core+0x46c/0x830
  ...
   rx_complete from __usb_hcd_giveback_urb+0xa4/0x12c
  Kernel panic - not syncing: Fatal exception in interrupt

> - What hardware the change was tested on. For driver fixes please
>   mention the device (and if relevant firmware version) used for
>   testing, or say that the change was not tested on real hardware.

NXP LS1021A board (eTSEC) on a 6.18.62 based kernel. With the fix, the
same test ran 90 bounces with no warnings or crashes. On top of the net
tree, the patch was only build tested (ARM multi_v7_defconfig, W=1).