Re: [PATCH 1/3] net: macb: never give hardware a NULL RX buffer

[Nicolai Buchwitz <nb@tipi-net.de>]

On 18.9.2026 22:32, Théo Lebrun wrote:
> The refill logic is simple: iterate over all pending rx slots, allocate
> SKB (& DMA map) if needed and hand it off the to hardware by clearing
> the RX_USED flag.
> 
> If the refill operation fails mid-way, it early returns leaving the
> following slots untouched. In the normal case that is fine, because all
> slots have been properly initialised (and might have been already used
> by HW meaning they won't be reused). When slots have not been
> initialised however, we are in trouble.
> 
> After dma_alloc_coherent() of the rx ring buffer, all slots have NULL
> pointers and RX_USED cleared meaning HW will try using them. Ensure
> this does not happen by setting the RX_USED flag on all slots before
> calling refill at buffer alloc, in gem_init_rx_ring(). That way even if
> refill fails on an alloc/dma_map, the HW won't try using NULL pointers
> as buffers.
> 
> Theoretical bugfix, never encountered in practice. To reproduce,
> introduce memory pressure (less than 512 SKBs of free memory) and open
> the interface.
> 
> Note that this codepath also hits at resume, on HRESP errors and on
> set_ringparam (while interface is running).
> 
> Fixes: 4df95131ea80 ("net/macb: change RX path for GEM")
> Cc: stable@vger.kernel.org
> Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
> ---
>  drivers/net/ethernet/cadence/macb_main.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/cadence/macb_main.c 
> b/drivers/net/ethernet/cadence/macb_main.c
> index b8234ac4b602..751fa9e68099 100644
> --- a/drivers/net/ethernet/cadence/macb_main.c
> +++ b/drivers/net/ethernet/cadence/macb_main.c
> @@ -2785,9 +2785,14 @@ static int macb_alloc(struct macb *bp)
> 
>  static void gem_init_rx_ring(struct macb_queue *queue)
>  {
> +	unsigned int i;
> +
>  	queue->rx_tail = 0;
>  	queue->rx_prepared_head = 0;
> 
> +	for (i = 0; i < queue->bp->rx_ring_size; i++)
> +		macb_rx_desc(queue, i)->addr |= MACB_BIT(RX_USED);
> +
>  	gem_rx_refill(queue);
>  }

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Regards
Nicolai