drivers/net/ethernet/cadence/macb_main.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
Now the MACB ethernet driver print the netdev error information
directly by netdev_err(), which would lead to a large number of
error information print if there was a significant number of
error or just jumbo packets received when booting.
For example, it would print a large number of:
macb PHYT0036:00 eth0: not whole frame pointed by descriptor
macb PHYT0036:00 eth0: not whole frame pointed by descriptor
...
in gem_rx() by received a large number of packets without
RX_SOF or RX_EOF flag set.
The unlimited print here would greatly bother and delay
the system booting process unless the source stop sending
packets.
So rate limit the netdev error information print in the receive
and transmit data path.
Signed-off-by: Zijin Tao <taozj888@163.com>
---
drivers/net/ethernet/cadence/macb_main.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index b8234ac4b602..c32d48d03008 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1617,16 +1617,16 @@ static int gem_rx(struct macb_queue *queue, struct napi_struct *napi,
count++;
if (!(ctrl & MACB_BIT(RX_SOF) && ctrl & MACB_BIT(RX_EOF))) {
- netdev_err(bp->netdev,
- "not whole frame pointed by descriptor\n");
+ if (net_ratelimit())
+ netdev_err(bp->netdev, "not whole frame pointed by descriptor\n");
bp->netdev->stats.rx_dropped++;
queue->stats.rx_dropped++;
break;
}
skb = queue->rx_skbuff[entry];
if (unlikely(!skb)) {
- netdev_err(bp->netdev,
- "inconsistent Rx descriptor chain\n");
+ if (net_ratelimit())
+ netdev_err(bp->netdev, "inconsistent Rx descriptor chain\n");
bp->netdev->stats.rx_dropped++;
queue->stats.rx_dropped++;
break;
@@ -1829,7 +1829,8 @@ static int macb_rx(struct macb_queue *queue, struct napi_struct *napi,
unsigned long flags;
u32 ctrl;
- netdev_err(bp->netdev, "RX queue corruption: reset it\n");
+ if (net_ratelimit())
+ netdev_err(bp->netdev, "RX queue corruption: reset it\n");
spin_lock_irqsave(&bp->lock, flags);
@@ -2102,7 +2103,8 @@ static int macb_interrupt_misc(struct macb_queue *queue, u32 status)
if (status & MACB_BIT(HRESP)) {
queue_work(system_bh_wq, &bp->hresp_err_bh_work);
- netdev_err(netdev, "DMA bus error: HRESP not OK\n");
+ if (net_ratelimit())
+ netdev_err(netdev, "DMA bus error: HRESP not OK\n");
macb_queue_isr_clear(bp, queue, MACB_BIT(HRESP));
}
@@ -2511,7 +2513,8 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb,
else
hdrlen = skb_tcp_all_headers(skb);
if (skb_headlen(skb) < hdrlen) {
- netdev_err(bp->netdev, "Error - LSO headers fragmented!!!\n");
+ if (net_ratelimit())
+ netdev_err(bp->netdev, "Error - LSO headers fragmented!!!\n");
/* if this is required, would need to copy to single buffer */
return NETDEV_TX_BUSY;
}
--
2.34.1Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider.
Critical: 0 (1) · High: 1 · Medium: 0 · Low: 1
If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).
- [High] Incomplete fix: the patch rate-limits only 4 netdev_err() sites,
leaving the equally floodable peer prints in the very same RX/TX data…
- [Low] The commit message describes a user-visible defect (unbounded
console flooding from gem_rx() delaying boot) but carries only a…
Pre-existing issues:
- [Critical] Use-after-free of the skb the network stack still owns:
macb_start_xmit() calls macb_pad_and_fcs(&skb, netdev) at…
--
net: macb: rate limit netdev error info print in the data path
The patch wraps five netdev_err() calls in the macb receive and transmit
paths with net_ratelimit(), so a flood of bad descriptors or LSO errors no
longer prints unbounded messages. The motivating case is "not whole frame
pointed by descriptor" repeating from gem_rx() during boot.
No Link: tags were present in the commit header.
[Severity: Low]
This isn't a bug in the code, but the changelog describes a user-visible
defect (boot delayed by unbounded printing from gem_rx()) and the patch
carries only:
Signed-off-by: Zijin Tao <taozj888@163.com>
Should this carry a Fixes tag and name the intended tree? The unconditional
print in gem_rx() goes back to commit 4df95131ea80 ("net/macb: change RX
path for GEM"), which isn't referenced, and there is no note about whether
this is aimed at net or net-next.
> diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
> index b8234ac4b602..c32d48d03008 100644
> --- a/drivers/net/ethernet/cadence/macb_main.c
> +++ b/drivers/net/ethernet/cadence/macb_main.c
> @@ -1617,16 +1617,16 @@ static int gem_rx(struct macb_queue *queue, struct napi_struct *napi,
> count++;
>
> if (!(ctrl & MACB_BIT(RX_SOF) && ctrl & MACB_BIT(RX_EOF))) {
> - netdev_err(bp->netdev,
> - "not whole frame pointed by descriptor\n");
> + if (net_ratelimit())
> + netdev_err(bp->netdev, "not whole frame pointed by descriptor\n");
> bp->netdev->stats.rx_dropped++;
> queue->stats.rx_dropped++;
> break;
> }
> skb = queue->rx_skbuff[entry];
> if (unlikely(!skb)) {
> - netdev_err(bp->netdev,
> - "inconsistent Rx descriptor chain\n");
> + if (net_ratelimit())
> + netdev_err(bp->netdev, "inconsistent Rx descriptor chain\n");
> bp->netdev->stats.rx_dropped++;
> queue->stats.rx_dropped++;
> break;
[Severity: High]
The changelog says the change will "rate limit the netdev error information
print in the receive and transmit data path", but several equally floodable
netdev_err() calls in the same paths are left as they are. Can the same
console flood still be produced through them?
In the receive path, gem_rx() ends with gem_rx_refill(queue), which prints
once per NAPI poll while allocations keep failing:
drivers/net/ethernet/cadence/macb_main.c:gem_rx_refill() {
...
skb = netdev_alloc_skb(bp->netdev, bp->rx_buffer_size);
if (unlikely(!skb)) {
netdev_err(bp->netdev,
"Unable to allocate sk_buff\n");
break;
}
...
}
In the transmit path, macb_start_xmit() -> macb_tx_map() prints once per
skb, and a dma_map failure tends to persist:
drivers/net/ethernet/cadence/macb_main.c:macb_tx_map() {
...
/* Should never happen */
if (unlikely(!tx_skb)) {
netdev_err(bp->netdev, "BUG! empty skb!\n");
return 0;
}
...
dma_error:
netdev_err(bp->netdev, "TX DMA map failed\n");
...
}
The at91ether entry points in the same file are in the same situation.
at91ether_start_xmit() returns NETDEV_TX_BUSY from the busy branch, so
sch_direct_xmit() -> dev_requeue_skb() -> __netif_schedule() retries the
same skb and the message can repeat at softirq rate:
drivers/net/ethernet/cadence/macb_main.c:at91ether_start_xmit() {
...
if (dma_mapping_error(dev, bp->rm9200_txq[desc].mapping)) {
dev_kfree_skb_any(skb);
netdev->stats.tx_dropped++;
netdev_err(netdev, "%s: DMA mapping error\n", __func__);
return NETDEV_TX_OK;
}
...
} else {
netdev_err(netdev, "%s called, but device is busy!\n",
__func__);
return NETDEV_TX_BUSY;
}
}
And at91ether_interrupt() prints from hard IRQ on every receive overrun,
which is the same remotely triggered error storm the changelog describes:
drivers/net/ethernet/cadence/macb_main.c:at91ether_interrupt() {
...
if (intstatus & MACB_BIT(ISR_ROVR))
netdev_err(netdev, "ROVR error\n");
...
}
Would it make sense to convert these as well, or to narrow the changelog to
the sites that are actually covered?
[ ... ]
> @@ -2511,7 +2513,8 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb,
> else
> hdrlen = skb_tcp_all_headers(skb);
> if (skb_headlen(skb) < hdrlen) {
> - netdev_err(bp->netdev, "Error - LSO headers fragmented!!!\n");
> + if (net_ratelimit())
> + netdev_err(bp->netdev, "Error - LSO headers fragmented!!!\n");
> /* if this is required, would need to copy to single buffer */
> return NETDEV_TX_BUSY;
> }
[Severity: Critical]
This isn't a bug introduced by this patch, but while looking at the
NETDEV_TX_BUSY returns in macb_start_xmit(): can the non-LSO ring-full
return use an skb that was already freed?
macb_start_xmit() calls macb_pad_and_fcs(&skb, netdev) early on, and that
helper can free the pointer the transmit core still holds:
drivers/net/ethernet/cadence/macb_main.c:macb_pad_and_fcs() {
...
if (cloned || tailroom < padlen) {
nskb = skb_copy_expand(*skb, 0, padlen, GFP_ATOMIC);
if (!nskb)
return -ENOMEM;
dev_consume_skb_any(*skb);
*skb = nskb;
}
...
}
Execution then continues, and the ring-full check can return
NETDEV_TX_BUSY:
drivers/net/ethernet/cadence/macb_main.c:macb_start_xmit() {
...
if (CIRC_SPACE(queue->tx_head, queue->tx_tail,
bp->tx_ring_size) < desc_cnt) {
netif_stop_subqueue(netdev, q);
...
ret = NETDEV_TX_BUSY;
goto unlock;
}
...
}
NETDEV_TX_BUSY is not a completion status, so the core writes into the skb
it passed in and then requeues it:
net/core/dev.c:dev_hard_start_xmit() {
...
rc = xmit_one(skb, dev, txq, next != NULL);
if (unlikely(!dev_xmit_complete(rc))) {
skb->next = next;
goto out;
}
...
}
sch_direct_xmit() then hands that pointer to dev_requeue_skb(), which
stores it in q->gso_skb for a later dequeue and transmit.
Both conditions look independently satisfiable: a short or tailroom-poor,
non-CHECKSUM_PARTIAL, cloned or nonlinear frame on a NETIF_F_HW_CSUM
interface gets replaced by macb_pad_and_fcs(), and CIRC_SPACE() can be
below desc_cnt at that moment under sustained transmit load.
The LSO branch shown in this hunk avoids the sequence only because
macb_pad_and_fcs() returns 0 early when skb_shinfo(*skb)->gso_size is set.
Is the non-LSO ring-full path meant to return NETDEV_TX_BUSY after the skb
may have been replaced?
--
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260920095839.62852-1-taozj888%40163.com
Hello Zijin, You sent the same patch 3 times? Message-ID: <20260920095839.62852-1-taozj888@163.com> Message-ID: <20260920100658.65087-1-taozj888@163.com> Message-ID: <20260920100920.65773-1-taozj888@163.com> Also you are missing the prefix [PATCH net] or [PATCH net-next]. Read up about this here (and read the full page): https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html On Sun Sep 20, 2026 at 11:58 AM CEST, Zijin Tao wrote: > Now the MACB ethernet driver print the netdev error information > directly by netdev_err(), which would lead to a large number of > error information print if there was a significant number of > error or just jumbo packets received when booting. > For example, it would print a large number of: > > macb PHYT0036:00 eth0: not whole frame pointed by descriptor > macb PHYT0036:00 eth0: not whole frame pointed by descriptor > ... This whole patch is LLM generated? I don't think this "PHYT0036:00" device name could ever exist. Please don't hallucinate kernel logs. In both cases, I prefer the commit message to either indicate whether it is a theoretical bugfix or a bug hit in practice. I know I've faced such a log spam on MACB in the past, but I don't remember which log line it was. > in gem_rx() by received a large number of packets without > RX_SOF or RX_EOF flag set. > > The unlimited print here would greatly bother and delay > the system booting process unless the source stop sending > packets. I don't understand the relation to the booting process here. > So rate limit the netdev error information print in the receive > and transmit data path. > > Signed-off-by: Zijin Tao <taozj888@163.com> Thanks Zijin, -- Théo Lebrun, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
Hello Zijin, Also your To/Cc list is weird, make sure to use scripts/get_maintainer.pl (or use b4 for patch management which uses it automatically). On Mon Sep 21, 2026 at 10:58 AM CEST, Théo Lebrun wrote: > Hello Zijin, > > You sent the same patch 3 times? > Message-ID: <20260920095839.62852-1-taozj888@163.com> > Message-ID: <20260920100658.65087-1-taozj888@163.com> > Message-ID: <20260920100920.65773-1-taozj888@163.com> > > Also you are missing the prefix [PATCH net] or [PATCH net-next]. > Read up about this here (and read the full page): > https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html > > On Sun Sep 20, 2026 at 11:58 AM CEST, Zijin Tao wrote: >> Now the MACB ethernet driver print the netdev error information >> directly by netdev_err(), which would lead to a large number of >> error information print if there was a significant number of >> error or just jumbo packets received when booting. >> For example, it would print a large number of: >> >> macb PHYT0036:00 eth0: not whole frame pointed by descriptor >> macb PHYT0036:00 eth0: not whole frame pointed by descriptor >> ... > > This whole patch is LLM generated? I don't think this "PHYT0036:00" > device name could ever exist. Please don't hallucinate kernel logs. > > In both cases, I prefer the commit message to either indicate whether it > is a theoretical bugfix or a bug hit in practice. I know I've faced > such a log spam on MACB in the past, but I don't remember which log > line it was. > >> in gem_rx() by received a large number of packets without >> RX_SOF or RX_EOF flag set. >> >> The unlimited print here would greatly bother and delay >> the system booting process unless the source stop sending >> packets. > > I don't understand the relation to the booting process here. > >> So rate limit the netdev error information print in the receive >> and transmit data path. >> >> Signed-off-by: Zijin Tao <taozj888@163.com> Thanks Zijin, -- Théo Lebrun, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
© 2016 - 2026 Red Hat, Inc.