From nobody Fri Oct 3 15:36:55 2025 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 242482690D5 for ; Thu, 28 Aug 2025 16:00:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756396858; cv=none; b=CZOB2id17HmzcFiqL+aPGyUDse/HGl3cdCuInhyCqf19td0lY/SNJD5RZOBSoUfH/f2oCUlNcQJ4OlID/zUbHkLZZGiOrzKbOLiRSIhxZidbEq7NLkqpsPqBV8PzhO1yxx8+nH4daMHrJK40PHQ8VUekpF6CS/G1SyGew6431Ug= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756396858; c=relaxed/simple; bh=hb7VLI6PShExv14ypYu5OGnNmdCKxSLa+baAX3y+iqo=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=hNufhOYbwfLcmsu5/HXg3RGVljcGjUgzGuv4gPU+QlyEzkQ+othS4vy2l70OB6+elWzznHD+I3jmkiCRHPMulFyb47/T+QhyYTa9aAGRK5Xqato3YPnH+Udvivn1jdygTl4D952F4sgHyigdYZoNYf7sp0+gLAJ11Jqp6o7oRtU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ehl5mmQp; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ehl5mmQp" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1756396854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=7IA/yEM1WqXtcqfvsUISFXQfmi98uZPiGjQuyyb+a6U=; b=ehl5mmQpH9uGJuClMpmdhKlCIapxp4QX65fLAHs1eVtiYCzdA+UbTvxBXYjCPIKFnSV9ni 7m4vkbnUJeFuQGZJpOjDdPLCHN1Gj3PcYDw7mX8NOeOObfAcwuzW9nS0owAuqSlLJ6mpwO Kvtwq1BxWhsmTDaMCt2UcSgdUywNsHA= From: Sean Anderson To: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org Cc: Robert Hancock , Mike Galbraith , Claudiu Beznea , linux-kernel@vger.kernel.org, Nicolas Ferre , Sean Anderson Subject: [PATCH] net: macb: Fix tx_ptr_lock locking Date: Thu, 28 Aug 2025 12:00:23 -0400 Message-Id: <20250828160023.1505762-1-sean.anderson@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" macb_start_xmit can be called with bottom-halves disabled (e.g. transmitting from softirqs) as well as with interrupts disabled (with netpoll). Because of this, all other functions taking tx_ptr_lock must disable IRQs, and macb_start_xmit must only re-enable IRQs if they were already enabled. Fixes: 138badbc21a0 ("net: macb: use NAPI for TX completion path") Reported-by: Mike Galbraith Signed-off-by: Sean Anderson --- drivers/net/ethernet/cadence/macb_main.c | 25 ++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/etherne= t/cadence/macb_main.c index 16d28a8b3b56..b0a8dfa341ea 100644 --- a/drivers/net/ethernet/cadence/macb_main.c +++ b/drivers/net/ethernet/cadence/macb_main.c @@ -1228,7 +1228,7 @@ static int macb_tx_complete(struct macb_queue *queue,= int budget) int packets =3D 0; u32 bytes =3D 0; =20 - spin_lock(&queue->tx_ptr_lock); + spin_lock_irq(&queue->tx_ptr_lock); head =3D queue->tx_head; for (tail =3D queue->tx_tail; tail !=3D head && packets < budget; tail++)= { struct macb_tx_skb *tx_skb; @@ -1291,7 +1291,7 @@ static int macb_tx_complete(struct macb_queue *queue,= int budget) CIRC_CNT(queue->tx_head, queue->tx_tail, bp->tx_ring_size) <=3D MACB_TX_WAKEUP_THRESH(bp)) netif_wake_subqueue(bp->dev, queue_index); - spin_unlock(&queue->tx_ptr_lock); + spin_unlock_irq(&queue->tx_ptr_lock); =20 return packets; } @@ -1708,7 +1708,7 @@ static void macb_tx_restart(struct macb_queue *queue) struct macb *bp =3D queue->bp; unsigned int head_idx, tbqp; =20 - spin_lock(&queue->tx_ptr_lock); + spin_lock_irq(&queue->tx_ptr_lock); =20 if (queue->tx_head =3D=3D queue->tx_tail) goto out_tx_ptr_unlock; @@ -1720,19 +1720,19 @@ static void macb_tx_restart(struct macb_queue *queu= e) if (tbqp =3D=3D head_idx) goto out_tx_ptr_unlock; =20 - spin_lock_irq(&bp->lock); + spin_lock(&bp->lock); macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART)); - spin_unlock_irq(&bp->lock); + spin_unlock(&bp->lock); =20 out_tx_ptr_unlock: - spin_unlock(&queue->tx_ptr_lock); + spin_unlock_irq(&queue->tx_ptr_lock); } =20 static bool macb_tx_complete_pending(struct macb_queue *queue) { bool retval =3D false; =20 - spin_lock(&queue->tx_ptr_lock); + spin_lock_irq(&queue->tx_ptr_lock); if (queue->tx_head !=3D queue->tx_tail) { /* Make hw descriptor updates visible to CPU */ rmb(); @@ -1740,7 +1740,7 @@ static bool macb_tx_complete_pending(struct macb_queu= e *queue) if (macb_tx_desc(queue, queue->tx_tail)->ctrl & MACB_BIT(TX_USED)) retval =3D true; } - spin_unlock(&queue->tx_ptr_lock); + spin_unlock_irq(&queue->tx_ptr_lock); return retval; } =20 @@ -2308,6 +2308,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *sk= b, struct net_device *dev) struct macb_queue *queue =3D &bp->queues[queue_index]; unsigned int desc_cnt, nr_frags, frag_size, f; unsigned int hdrlen; + unsigned long flags; bool is_lso; netdev_tx_t ret =3D NETDEV_TX_OK; =20 @@ -2368,7 +2369,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *sk= b, struct net_device *dev) desc_cnt +=3D DIV_ROUND_UP(frag_size, bp->max_tx_length); } =20 - spin_lock_bh(&queue->tx_ptr_lock); + spin_lock_irqsave(&queue->tx_ptr_lock, flags); =20 /* This is a hard error, log it. */ if (CIRC_SPACE(queue->tx_head, queue->tx_tail, @@ -2392,15 +2393,15 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *= skb, struct net_device *dev) netdev_tx_sent_queue(netdev_get_tx_queue(bp->dev, queue_index), skb->len); =20 - spin_lock_irq(&bp->lock); + spin_lock(&bp->lock); macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART)); - spin_unlock_irq(&bp->lock); + spin_unlock(&bp->lock); =20 if (CIRC_SPACE(queue->tx_head, queue->tx_tail, bp->tx_ring_size) < 1) netif_stop_subqueue(dev, queue_index); =20 unlock: - spin_unlock_bh(&queue->tx_ptr_lock); + spin_unlock_irqrestore(&queue->tx_ptr_lock, flags); =20 return ret; } --=20 2.35.1.1320.gc452695387.dirty