From nobody Mon Feb 9 05:25:05 2026 Received: from esa.microchip.iphmx.com (esa.microchip.iphmx.com [68.232.154.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 092041DCB09; Fri, 13 Dec 2024 12:32:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=68.232.154.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734093152; cv=none; b=fLktiNXjyz/W7n5gtpmXZjOTjmRnQzJT4nlyECbBdKlNtL2txGcERBQV8zWVBNKBG84ahLcI/wYntHNrtIP2YVeRBBgAOlyIk6giL34QE44FN4taCg+TMKBrmk9baZf83TTLGWqEi/Ese2rgV0XM0L7H59fwXda26QnAl732yKM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734093152; c=relaxed/simple; bh=Cmo6WDz3rC/L7dCSEvrpYVHvneSHBq6A6CB+GmSheiY=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Ia47LVIWPT73bGhHbS5b8XWOvYgCg6di2370mroDcNC9yMCQPJm8f/MbcmTubzL8jOYDxvBM5BB/akj412V7aQ/DfjdoDzN9cMe+DHMBEGN3wtTT4R7gS5JI2BjZY5PIsbwOCXvCyz8rsqaBNAvCCJAIGQIica71Iqxzn+y0HZ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=microchip.com; spf=pass smtp.mailfrom=microchip.com; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b=Ih816SSC; arc=none smtp.client-ip=68.232.154.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=microchip.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=microchip.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b="Ih816SSC" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1734093150; x=1765629150; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Cmo6WDz3rC/L7dCSEvrpYVHvneSHBq6A6CB+GmSheiY=; b=Ih816SSCykOLzoYb0FwNVluj0bOgXdgqhcjB895UwPGV2dkapOaNnyLt IQ1epgmYvhrNm65EnOGRid3Em21ifG2FP1vOAj2s+NSpc28Pq/bkOLGpd mSF4xICEZNXXR81tjcgatY/JOYLboa8/fDa6jVzf5VVyYwCDl/xrDlCIQ K+BcFq2tj6cTWvQKwXuQ18humO+1ozUULYqzZJAN9UFINBk93dawiMCK4 0STdLMoFqzi7M4HUGqN++GiiYnCkLWLT2sqqu2qbJOYMAwBMIuKq/kt65 XJXTCm5tTlyB19Tv79gCwZUslN05dFWLQ1eirRWg/62pPDj4lHJ0/P4jg g==; X-CSE-ConnectionGUID: T4iONzRASJC/nLtS7vBTbg== X-CSE-MsgGUID: vmjulHARRTa/MJnIVnitFQ== X-IronPort-AV: E=Sophos;i="6.12,231,1728975600"; d="scan'208";a="35183035" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO email.microchip.com) ([170.129.1.10]) by esa4.microchip.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 13 Dec 2024 05:32:26 -0700 Received: from chn-vm-ex02.mchp-main.com (10.10.87.72) by chn-vm-ex02.mchp-main.com (10.10.87.72) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Fri, 13 Dec 2024 05:32:13 -0700 Received: from che-ll-i17164.microchip.com (10.10.85.11) by chn-vm-ex02.mchp-main.com (10.10.85.144) with Microsoft SMTP Server id 15.1.2507.35 via Frontend Transport; Fri, 13 Dec 2024 05:32:10 -0700 From: Parthiban Veerasooran To: , , , , CC: , , , , Subject: [PATCH net v4 1/2] net: ethernet: oa_tc6: fix infinite loop error when tx credits becomes 0 Date: Fri, 13 Dec 2024 18:01:58 +0530 Message-ID: <20241213123159.439739-2-parthiban.veerasooran@microchip.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20241213123159.439739-1-parthiban.veerasooran@microchip.com> References: <20241213123159.439739-1-parthiban.veerasooran@microchip.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" SPI thread wakes up to perform SPI transfer whenever there is an TX skb from n/w stack or interrupt from MAC-PHY. Ethernet frame from TX skb is transferred based on the availability tx credits in the MAC-PHY which is reported from the previous SPI transfer. Sometimes there is a possibility that TX skb is available to transmit but there is no tx credits from MAC-PHY. In this case, there will not be any SPI transfer but the thread will be running in an endless loop until tx credits available again. So checking the availability of tx credits along with TX skb will prevent the above infinite loop. When the tx credits available again that will be notified through interrupt which will trigger the SPI transfer to get the available tx credits. Fixes: 53fbde8ab21e ("net: ethernet: oa_tc6: implement transmit path to tra= nsfer tx ethernet frames") Reviewed-by: Jacob Keller Signed-off-by: Parthiban Veerasooran --- drivers/net/ethernet/oa_tc6.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c index f9c0dcd965c2..4c8b0ca922b7 100644 --- a/drivers/net/ethernet/oa_tc6.c +++ b/drivers/net/ethernet/oa_tc6.c @@ -1111,8 +1111,9 @@ static int oa_tc6_spi_thread_handler(void *data) /* This kthread will be waken up if there is a tx skb or mac-phy * interrupt to perform spi transfer with tx chunks. */ - wait_event_interruptible(tc6->spi_wq, tc6->waiting_tx_skb || - tc6->int_flag || + wait_event_interruptible(tc6->spi_wq, tc6->int_flag || + (tc6->waiting_tx_skb && + tc6->tx_credits) || kthread_should_stop()); =20 if (kthread_should_stop()) --=20 2.34.1 From nobody Mon Feb 9 05:25:05 2026 Received: from esa.microchip.iphmx.com (esa.microchip.iphmx.com [68.232.154.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 996AC1DF97A; Fri, 13 Dec 2024 12:32:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=68.232.154.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734093153; cv=none; b=N1U/hoIAOAB6cc5eXKFvui+ZHyaUe8m7UJFUnryBBqYxut5vEBdBz7hFObi5onUbuK6Y3sYboU7D6oXGzTPL2CBz4iMDnTYNUG3YgRo51wTlGjeql0odcbrRLRKAOPqKHfHC6orx3IvYkNTtwA5JEpQy2beYIqc965PpcRSHoOE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734093153; c=relaxed/simple; bh=8bsBblHZ5HPCS/0voc9auFAQnDpRi3kvKg2hfGu9DYI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HBgLMkz05gneBUcorrSS7dtctj4Fg3m0UKnn7NBB9qcDYmLEccI2cEVDLsb/6uwc+fu7llQqo2PSoRip/AqDPkDWlHoMODM7zk31SIyD96P0JeTjq+x/JCDY0uVpioBlDO2LGj5hatvQesj/VzbFIEFTVxhcTMbdRmWFzRGKZB0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=microchip.com; spf=pass smtp.mailfrom=microchip.com; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b=T4NC2HZs; arc=none smtp.client-ip=68.232.154.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=microchip.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=microchip.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=microchip.com header.i=@microchip.com header.b="T4NC2HZs" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1734093151; x=1765629151; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=8bsBblHZ5HPCS/0voc9auFAQnDpRi3kvKg2hfGu9DYI=; b=T4NC2HZstTIaBtMS8Biz4ElyRaEJ4Ckdhrmtue0R1g4uNUPZsYFdYscU EXzvsZUPtpEj69cEQvkIEQQI4dWtEx59k0peDd0iTwWhjIfOow0nt2PYn kqP3qI0jceIxb2qJZr2UBzABLNY6ufK7ePKT2dkDYTGhoxiLJ7STTMOXO MUbP3u3/vpH60sP3d59ac9dHDeCvH4PTyWctlufBFFIW3078Dj4IYW1G8 b8P+0j9xOXsQFlpavWKvcRCSPTc3PWL5mBglgCSL3xTXKfrBMB5kzOUiy aW1Fhchc15/aqPaLoAD8wXXaU1vvyOiSQO5wy1CtWrydKl1QnMi1p8ylO g==; X-CSE-ConnectionGUID: T4iONzRASJC/nLtS7vBTbg== X-CSE-MsgGUID: wfiaStY1STeeGdAxq3S2ww== X-IronPort-AV: E=Sophos;i="6.12,231,1728975600"; d="scan'208";a="35183036" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO email.microchip.com) ([170.129.1.10]) by esa4.microchip.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 13 Dec 2024 05:32:26 -0700 Received: from chn-vm-ex02.mchp-main.com (10.10.87.72) by chn-vm-ex02.mchp-main.com (10.10.87.72) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Fri, 13 Dec 2024 05:32:17 -0700 Received: from che-ll-i17164.microchip.com (10.10.85.11) by chn-vm-ex02.mchp-main.com (10.10.85.144) with Microsoft SMTP Server id 15.1.2507.35 via Frontend Transport; Fri, 13 Dec 2024 05:32:13 -0700 From: Parthiban Veerasooran To: , , , , CC: , , , , Subject: [PATCH net v4 2/2] net: ethernet: oa_tc6: fix tx skb race condition between reference pointers Date: Fri, 13 Dec 2024 18:01:59 +0530 Message-ID: <20241213123159.439739-3-parthiban.veerasooran@microchip.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20241213123159.439739-1-parthiban.veerasooran@microchip.com> References: <20241213123159.439739-1-parthiban.veerasooran@microchip.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" There are two skb pointers to manage tx skb's enqueued from n/w stack. waiting_tx_skb pointer points to the tx skb which needs to be processed and ongoing_tx_skb pointer points to the tx skb which is being processed. SPI thread prepares the tx data chunks from the tx skb pointed by the ongoing_tx_skb pointer. When the tx skb pointed by the ongoing_tx_skb is processed, the tx skb pointed by the waiting_tx_skb is assigned to ongoing_tx_skb and the waiting_tx_skb pointer is assigned with NULL. Whenever there is a new tx skb from n/w stack, it will be assigned to waiting_tx_skb pointer if it is NULL. Enqueuing and processing of a tx skb handled in two different threads. Consider a scenario where the SPI thread processed an ongoing_tx_skb and it moves next tx skb from waiting_tx_skb pointer to ongoing_tx_skb pointer without doing any NULL check. At this time, if the waiting_tx_skb pointer is NULL then ongoing_tx_skb pointer is also assigned with NULL. After that, if a new tx skb is assigned to waiting_tx_skb pointer by the n/w stack and there is a chance to overwrite the tx skb pointer with NULL in the SPI thread. Finally one of the tx skb will be left as unhandled, resulting packet missing and memory leak. - Consider the below scenario where the TXC reported from the previous transfer is 10 and ongoing_tx_skb holds an tx ethernet frame which can be transported in 20 TXCs and waiting_tx_skb is still NULL. tx_credits =3D 10; /* 21 are filled in the previous transfer */ ongoing_tx_skb =3D 20; waiting_tx_skb =3D NULL; /* Still NULL */ - So, (tc6->ongoing_tx_skb || tc6->waiting_tx_skb) becomes true. - After oa_tc6_prepare_spi_tx_buf_for_tx_skbs() ongoing_tx_skb =3D 10; waiting_tx_skb =3D NULL; /* Still NULL */ - Perform SPI transfer. - Process SPI rx buffer to get the TXC from footers. - Now let's assume previously filled 21 TXCs are freed so we are good to transport the next remaining 10 tx chunks from ongoing_tx_skb. tx_credits =3D 21; ongoing_tx_skb =3D 10; waiting_tx_skb =3D NULL; - So, (tc6->ongoing_tx_skb || tc6->waiting_tx_skb) becomes true again. - In the oa_tc6_prepare_spi_tx_buf_for_tx_skbs() ongoing_tx_skb =3D NULL; waiting_tx_skb =3D NULL; - Now the below bad case might happen, Thread1 (oa_tc6_start_xmit) Thread2 (oa_tc6_spi_thread_handler) Reviewed-by: Larysa Zaremba --------------------------- ----------------------------------- - if waiting_tx_skb is NULL - if ongoing_tx_skb is NULL - ongoing_tx_skb =3D waiting_tx_skb - waiting_tx_skb =3D skb - waiting_tx_skb =3D NULL ... - ongoing_tx_skb =3D NULL - if waiting_tx_skb is NULL - waiting_tx_skb =3D skb To overcome the above issue, protect the moving of tx skb reference from waiting_tx_skb pointer to ongoing_tx_skb pointer and assigning new tx skb to waiting_tx_skb pointer, so that the other thread can't access the waiting_tx_skb pointer until the current thread completes moving the tx skb reference safely. Fixes: 53fbde8ab21e ("net: ethernet: oa_tc6: implement transmit path to tra= nsfer tx ethernet frames") Signed-off-by: Parthiban Veerasooran --- drivers/net/ethernet/oa_tc6.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c index 4c8b0ca922b7..db200e4ec284 100644 --- a/drivers/net/ethernet/oa_tc6.c +++ b/drivers/net/ethernet/oa_tc6.c @@ -113,6 +113,7 @@ struct oa_tc6 { struct mii_bus *mdiobus; struct spi_device *spi; struct mutex spi_ctrl_lock; /* Protects spi control transfer */ + spinlock_t tx_skb_lock; /* Protects tx skb handling */ void *spi_ctrl_tx_buf; void *spi_ctrl_rx_buf; void *spi_data_tx_buf; @@ -1004,8 +1005,10 @@ static u16 oa_tc6_prepare_spi_tx_buf_for_tx_skbs(str= uct oa_tc6 *tc6) for (used_tx_credits =3D 0; used_tx_credits < tc6->tx_credits; used_tx_credits++) { if (!tc6->ongoing_tx_skb) { + spin_lock_bh(&tc6->tx_skb_lock); tc6->ongoing_tx_skb =3D tc6->waiting_tx_skb; tc6->waiting_tx_skb =3D NULL; + spin_unlock_bh(&tc6->tx_skb_lock); } if (!tc6->ongoing_tx_skb) break; @@ -1210,7 +1213,9 @@ netdev_tx_t oa_tc6_start_xmit(struct oa_tc6 *tc6, str= uct sk_buff *skb) return NETDEV_TX_OK; } =20 + spin_lock_bh(&tc6->tx_skb_lock); tc6->waiting_tx_skb =3D skb; + spin_unlock_bh(&tc6->tx_skb_lock); =20 /* Wake spi kthread to perform spi transfer */ wake_up_interruptible(&tc6->spi_wq); @@ -1240,6 +1245,7 @@ struct oa_tc6 *oa_tc6_init(struct spi_device *spi, st= ruct net_device *netdev) tc6->netdev =3D netdev; SET_NETDEV_DEV(netdev, &spi->dev); mutex_init(&tc6->spi_ctrl_lock); + spin_lock_init(&tc6->tx_skb_lock); =20 /* Set the SPI controller to pump at realtime priority */ tc6->spi->rt =3D true; --=20 2.34.1