| b.liu | e958203 | 2025-04-17 19:18:16 +0800 | [diff] [blame^] | 1 | From ef3556ee16c68735ec69bd08df41d1cd83b14ad3 Mon Sep 17 00:00:00 2001 |
| 2 | From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> |
| 3 | Date: Thu, 27 Oct 2022 13:24:30 +0200 |
| 4 | Subject: [PATCH] net: broadcom: bcm4908_enet: update TX stats after actual |
| 5 | transmission |
| 6 | MIME-Version: 1.0 |
| 7 | Content-Type: text/plain; charset=UTF-8 |
| 8 | Content-Transfer-Encoding: 8bit |
| 9 | |
| 10 | Queueing packets doesn't guarantee their transmission. Update TX stats |
| 11 | after hardware confirms consuming submitted data. |
| 12 | |
| 13 | This also fixes a possible race and NULL dereference. |
| 14 | bcm4908_enet_start_xmit() could try to access skb after freeing it in |
| 15 | the bcm4908_enet_poll_tx(). |
| 16 | |
| 17 | Reported-by: Florian Fainelli <f.fainelli@gmail.com> |
| 18 | Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver") |
| 19 | Signed-off-by: Rafał Miłecki <rafal@milecki.pl> |
| 20 | Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> |
| 21 | Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com |
| 22 | Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| 23 | --- |
| 24 | drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++---- |
| 25 | 1 file changed, 8 insertions(+), 4 deletions(-) |
| 26 | |
| 27 | --- a/drivers/net/ethernet/broadcom/bcm4908_enet.c |
| 28 | +++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c |
| 29 | @@ -560,8 +560,6 @@ static int bcm4908_enet_start_xmit(struc |
| 30 | |
| 31 | if (++ring->write_idx == ring->length - 1) |
| 32 | ring->write_idx = 0; |
| 33 | - enet->netdev->stats.tx_bytes += skb->len; |
| 34 | - enet->netdev->stats.tx_packets++; |
| 35 | |
| 36 | return NETDEV_TX_OK; |
| 37 | } |
| 38 | @@ -634,6 +632,7 @@ static int bcm4908_enet_poll_tx(struct n |
| 39 | struct bcm4908_enet_dma_ring_bd *buf_desc; |
| 40 | struct bcm4908_enet_dma_ring_slot *slot; |
| 41 | struct device *dev = enet->dev; |
| 42 | + unsigned int bytes = 0; |
| 43 | int handled = 0; |
| 44 | |
| 45 | while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) { |
| 46 | @@ -644,12 +643,17 @@ static int bcm4908_enet_poll_tx(struct n |
| 47 | |
| 48 | dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE); |
| 49 | dev_kfree_skb(slot->skb); |
| 50 | - if (++tx_ring->read_idx == tx_ring->length) |
| 51 | - tx_ring->read_idx = 0; |
| 52 | |
| 53 | handled++; |
| 54 | + bytes += slot->len; |
| 55 | + |
| 56 | + if (++tx_ring->read_idx == tx_ring->length) |
| 57 | + tx_ring->read_idx = 0; |
| 58 | } |
| 59 | |
| 60 | + enet->netdev->stats.tx_packets += handled; |
| 61 | + enet->netdev->stats.tx_bytes += bytes; |
| 62 | + |
| 63 | if (handled < weight) { |
| 64 | napi_complete_done(napi, handled); |
| 65 | bcm4908_enet_dma_ring_intrs_on(enet, tx_ring); |