Re: [PATCH net] net: bcmgenet: unshare the skb before writing the control block

[Florian Fainelli <florian.fainelli@broadcom.com>]

On 10/9/26 03:10, Nicolai Buchwitz wrote:
> bcmgenet stores first_cb, last_cb and bytes_sent in the skb control
> block and reads them back on completion to free the skb and credit BQL.
> ether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit
> a shared skb that is still in the ring. The next transmit overwrites
> last_cb, so the earlier slots complete without crediting their bytes
> and BQL stalls the queue until the watchdog resets it.
> 
> Unshare the skb before writing the control block.
> 
> Reproduce with pktgen in clone_skb mode, which hands the driver the same
> skb while earlier copies are still in the ring:
> 
>    modprobe pktgen
>    pg=/proc/net/pktgen
>    echo "add_device eth0" > $pg/kpktgend_0
>    echo "dst_mac AA:BB:CC:DD:EE:FF" > $pg/eth0
>    echo "dst 192.0.2.1" > $pg/eth0
>    echo "clone_skb 8" > $pg/eth0
>    echo "count 0" > $pg/eth0
>    echo start > $pg/pgctrl &
>    sleep 5
>    echo stop > $pg/pgctrl
>    wait
>    cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight
> 
> inflight stays nonzero on the now idle queue. clone_skb 0 leaves it at
> zero.
> 
> Fixes: f48bed16a756 ("net: bcmgenet: Free skb after last Tx frag")
> Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>

Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian