From nobody Thu Sep 24 20:03:26 2026 Received: from mail.rimpianto.com (mail.rimpianto.com [46.14.198.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 788EA463B64; Mon, 21 Sep 2026 09:16:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=46.14.198.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789982206; cv=none; b=W4/OlRD8ptTMekBHXPvM49lc3quqDy+oYhH0lIHZX/EOUYa4783gLUC1TJRRDtaHeVP/N1hg2Hzf7fP5Et7ZH/QUkfguuEx+rm3cph7/gU7RcK93GiGen+Rs8Xq8xJr+iV42zJFN/XqlJ4Mp6einb8//SvTDLVdCXviYoAcZX/0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789982206; c=relaxed/simple; bh=LrlCW6ZSpn7jlrkMta+IC8b986oVFIukC7vKvzTqBGw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=D+rm83KwqWTTt+2J+aDbv9QG4iD4MM/eletxWSVFXeIh9MhrJwlzmkkBgkmur0Cub3sbj7vHZk/FASqdZ1l+Vw8ouriiTBtwY8EJyyBY97zbIrOiiQIfh0VKaEs7G8k5Pitb//VFsJ7loKYcdHSrJifUqMr/s3IQHI4M0zpJm5M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rimpianto.com; spf=pass smtp.mailfrom=rimpianto.com; dkim=pass (2048-bit key) header.d=rimpianto.com header.i=@rimpianto.com header.b=Menizlu/; arc=none smtp.client-ip=46.14.198.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rimpianto.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rimpianto.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rimpianto.com header.i=@rimpianto.com header.b="Menizlu/" Authentication-Results: mail.rimpianto.com; auth=pass (plain) From: =?UTF-8?q?Gajdos=20Tam=C3=A1s?= To: netdev@vger.kernel.org Cc: Chris Snook , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Gatis Peisenieks , linux-kernel@vger.kernel.org, =?UTF-8?q?Gajdos=20Tam=C3=A1s?= , stable@vger.kernel.org Subject: [PATCH 1/3] net: atl1c: fix soft lockup on out-of-range tpd_cons read Date: Mon, 21 Sep 2026 11:13:32 +0200 Message-ID: <20260921091334.3571525-2-tamas@rimpianto.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921091334.3571525-1-tamas@rimpianto.com> References: <20260921091334.3571525-1-tamas@rimpianto.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received: from localhost (Unknown [127.0.0.1]) by mail.rimpianto.com (Haraka) with ESMTPSA id C865C182-7EAA-4089-A7CF-1E4542A5B920.2 envelope-from tls TLS_AES_256_GCM_SHA384 (authenticated bits=0); Mon, 21 Sep 2026 11:15:30 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rimpianto.com; h=Content-Transfer-Encoding: Content-Type: MIME-Version: References: In-Reply-To: Message-ID: Date: Subject: Cc: To: From; q=dns/txt; s=s20260314391; t=1789982130; bh=Ze/67RO3SOQ4dYO1vQK/iZ4AhCadGBDBt2xXkaGnH9o=; b=Menizlu/IWLINNVLIv9y7n7GU7dzZ8nMgOP/ro5sEgk73wf4Iy2WKvwSDruE86PNbceZONJir c2zOOhcs8KM+vNm3OYfpK/xby4kRDUw6uY7j5OQtwiRB3wnICLGE92stdAd+olYM0b2IDyxwGA/ nTGRX6XQ9I2nftDwLNsAE1aG5yIbfkc6xy3aTEEWdGcaSY4PFFRw/3WdQ10URvKTQSekn3JoeDZ OtXvVkwVB4AKgA81XjEV371/HyKjou6ttXCVNHt/5uXuTfFGykOq++sCUB7TPwAnnB4SSdgaeE1 URLoCU+NJak3yG/TAelWPcEhilSDzN9chAJhIFFreUhg== The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead. Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to: - Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap precursor, before the lockup was captured with a full trace elsewhere: atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 = timed out 489984 ms atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for = 10ms second atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Dupl= ex> 65535 (0xffff) here is the same value tpd_cons reads back once the loop below gets stuck. - Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time caught by the soft lockup watchdog with a full stack trace: watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329] CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve= #1 PREEMPT(lazy) RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c] Call Trace: __napi_poll+0x32/0x1e0 napi_threaded_poll_loop+0x286/0x2e0 napi_threaded_poll+0xfd/0x140 kthread+0xf7/0x130 ret_from_fork+0x2da/0x3a0 ret_from_fork_asm+0x1a/0x30 Fixes: 43250ddd75a35d ("atl1c: Atheros L1C Gigabit Ethernet driver") Cc: stable@vger.kernel.org Signed-off-by: Gajdos Tam=C3=A1s --- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/= ethernet/atheros/atl1c/atl1c_main.c index 7efa3fc257..e58f1d2c26 100644 --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c @@ -1602,6 +1602,9 @@ static int atl1c_clean_tx(struct napi_struct *napi, i= nt budget) AT_READ_REGW(&adapter->hw, atl1c_qregs[tpd_ring->num].tpd_cons, &hw_next_to_clean); =20 + if (unlikely(hw_next_to_clean >=3D tpd_ring->count)) + hw_next_to_clean =3D next_to_clean; + while (next_to_clean !=3D hw_next_to_clean) { buffer_info =3D &tpd_ring->buffer_info[next_to_clean]; if (buffer_info->skb) { --=20 2.53.0 From nobody Thu Sep 24 20:03:26 2026 Received: from mail.rimpianto.com (mail.rimpianto.com [46.14.198.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE72A463B73; Mon, 21 Sep 2026 09:15:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=46.14.198.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789982138; cv=none; b=LNsDv9PrULGDEK9nL5oVpTS+vUqzZx0JdS+aRe/F72/5AQ26HCPBBmknSHQNyzCNh4Sfr/kCLNQRprdSQpPzM6khPWTPNMQREalXJMl4e5RPEbi5AVJle77Z5x4kqrDVnCr5waArsjoKb8lhAghouF24kYoNASTKc/sVr70v+vg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789982138; c=relaxed/simple; bh=RrmhCxTp1tw7yzpfL+BJQOikKGE/DiyOR2iXpwkZnms=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=MPhZbSS0ggRbo4k5XUyp5IzGd6weOygl6jCA6xJzDO9K+Nqy0zrXd7FqRnPfX/4Iw4lO2nNY3vY/7BR1ef0MS3GxcvXZTAN4Lr1+Lr5ebLpqf1Yd9KrwHVZe5OvUYhxzhudmGavyyJzTM438VaiEdqGOScYYm2cpY6KsVgJmdP8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rimpianto.com; spf=pass smtp.mailfrom=rimpianto.com; dkim=pass (2048-bit key) header.d=rimpianto.com header.i=@rimpianto.com header.b=Nc3faM3v; arc=none smtp.client-ip=46.14.198.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rimpianto.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rimpianto.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rimpianto.com header.i=@rimpianto.com header.b="Nc3faM3v" Authentication-Results: mail.rimpianto.com; auth=pass (plain) From: =?UTF-8?q?Gajdos=20Tam=C3=A1s?= To: netdev@vger.kernel.org Cc: Chris Snook , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Gatis Peisenieks , linux-kernel@vger.kernel.org, =?UTF-8?q?Gajdos=20Tam=C3=A1s?= , stable@vger.kernel.org Subject: [PATCH 2/3] net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Date: Mon, 21 Sep 2026 11:13:33 +0200 Message-ID: <20260921091334.3571525-3-tamas@rimpianto.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921091334.3571525-1-tamas@rimpianto.com> References: <20260921091334.3571525-1-tamas@rimpianto.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received: from localhost (Unknown [127.0.0.1]) by mail.rimpianto.com (Haraka) with ESMTPSA id C865C182-7EAA-4089-A7CF-1E4542A5B920.3 envelope-from tls TLS_AES_256_GCM_SHA384 (authenticated bits=0); Mon, 21 Sep 2026 11:15:33 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rimpianto.com; h=Content-Transfer-Encoding: Content-Type: MIME-Version: References: In-Reply-To: Message-ID: Date: Subject: Cc: To: From; q=dns/txt; s=s20260314391; t=1789982133; bh=WgHxkwyke+FWVPlHkGovNc+kxZLwkXgI2p3A8p7y4Cc=; b=Nc3faM3vwYa7TKVXq2Yi3IDIkBu6SoelhIb6W6/d9bl9goR/c/5By5lI5rbvyaoX8tsD+Cr7J vX7ByM8ouZ52YZqUO/89pzjI93+XMhTReWZCiuwYyVULktzbtQ1I8j/+nFO9zTPWl47eQ/Mg23u nZcgwPJ3gBn7/ufEip2zx4M12M6ts/MhHfJccNrywG2ChyH/XBnVvl2a36NJtKN92GqqrfYQmpa H/O9oE6Pm/kqXeBIGQHrGvKqVt63wS4OuLxF5v9tO3qmAmnTziBrWAbC46S0MkOeZhBh8wBr1Op gdtEDCfy6OnioJ0SL6ViCSCRzdqJuEuZDc8z9KH+G8kQ== Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range hw_next_to_clean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead. Fixes: a6a5325239c202 ("atl1e: Atheros L1E Gigabit Ethernet driver") Cc: stable@vger.kernel.org Signed-off-by: Gajdos Tam=C3=A1s --- drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/= ethernet/atheros/atl1e/atl1e_main.c index 4029002858..437989edb7 100644 --- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c @@ -1234,6 +1234,9 @@ static bool atl1e_clean_tx_irq(struct atl1e_adapter *= adapter) u16 hw_next_to_clean =3D AT_READ_REGW(&adapter->hw, REG_TPD_CONS_IDX); u16 next_to_clean =3D atomic_read(&tx_ring->next_to_clean); =20 + if (unlikely(hw_next_to_clean >=3D tx_ring->count)) + hw_next_to_clean =3D next_to_clean; + while (next_to_clean !=3D hw_next_to_clean) { tx_buffer =3D &tx_ring->tx_buffer[next_to_clean]; if (tx_buffer->dma) { --=20 2.53.0 From nobody Thu Sep 24 20:03:26 2026 Received: from mail.rimpianto.com (mail.rimpianto.com [46.14.198.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 96121468C2F; Mon, 21 Sep 2026 09:15:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=46.14.198.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789982140; cv=none; b=L51rNAyFXrGSFsAeING10JEen4Zziuo3rpk1Pg4CgXyubAg7UP0cq2kjYX86nBj3QwVm12f2VpnhinXJI4WHv2g+BJVH8EREQjPRHTXUv7BxvkP5vg9aHUzDJUtOyG5n3F7RLEaLprxUkULvZMkQIbqtNpoNaqga0GZ6SVSWsak= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789982140; c=relaxed/simple; bh=oXFx1YXt+xaIe4JMI/ge4AByv3hpdIZubFru4kJuJAY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ABjgctl4MueX+yPwA5bMO/Eydaqb4iC99R1dVilQJa+0DkkxCr8+Q3FCsrVl4fTDe7c1QqmEQVSZJKAR57n9LsG1uSl8vHNJvrtnDM0aHbh8V/AJkxftSsAL0IiQTDdN6SfxMvEGIxJK9mJC2Saqfm+8GKv8U4V49TDyQ4sqPXE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rimpianto.com; spf=pass smtp.mailfrom=rimpianto.com; dkim=pass (2048-bit key) header.d=rimpianto.com header.i=@rimpianto.com header.b=lqwRSxxl; arc=none smtp.client-ip=46.14.198.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rimpianto.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rimpianto.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rimpianto.com header.i=@rimpianto.com header.b="lqwRSxxl" Authentication-Results: mail.rimpianto.com; auth=pass (plain) From: =?UTF-8?q?Gajdos=20Tam=C3=A1s?= To: netdev@vger.kernel.org Cc: Chris Snook , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Gatis Peisenieks , linux-kernel@vger.kernel.org, =?UTF-8?q?Gajdos=20Tam=C3=A1s?= , stable@vger.kernel.org Subject: [PATCH 3/3] net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read Date: Mon, 21 Sep 2026 11:13:34 +0200 Message-ID: <20260921091334.3571525-4-tamas@rimpianto.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260921091334.3571525-1-tamas@rimpianto.com> References: <20260921091334.3571525-1-tamas@rimpianto.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received: from localhost (Unknown [127.0.0.1]) by mail.rimpianto.com (Haraka) with ESMTPSA id C865C182-7EAA-4089-A7CF-1E4542A5B920.4 envelope-from tls TLS_AES_256_GCM_SHA384 (authenticated bits=0); Mon, 21 Sep 2026 11:15:35 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rimpianto.com; h=Content-Transfer-Encoding: Content-Type: MIME-Version: References: In-Reply-To: Message-ID: Date: Subject: Cc: To: From; q=dns/txt; s=s20260314391; t=1789982136; bh=WIdms3fInvlDINNSk8nQtufSFWX3SIWm05qJbeVdHiw=; b=lqwRSxxl3A7GZmmQbPx0m8+qXBX0IhjwnmxANd3pf/RzOKJm7OEluHEMXCjHWRnioAnvXWMMz iO892bI28yWAbyRwf5MU+l26E/FRCY4Cxqlf0zErwd17IU9YxIr7GE3JERUar9S6KVDtJYHfosL fYMP5BagwirOuOTBANOB4yn2gClCyDdfHOakgCsS/qdya+mbzK7qKnxJ3CrguDpvtWzJjcKU9L9 F+ANCjGCKMLdU/g+TvxKwB5jOGx2VdIUboIebwW5t0vhsLbdLzyGAOrhPzJ0mhN0QEF5JhCKkhA /Zq0UcU7ZeZReKtqXX4qz9UyOewKmBOiziwWwkJsZ9Eg== Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range cmb_tpd_next_to_clean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead. Fixes: f3cc28c797604f ("Add Attansic L1 ethernet driver.") Cc: stable@vger.kernel.org Signed-off-by: Gajdos Tam=C3=A1s --- drivers/net/ethernet/atheros/atlx/atl1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/etherne= t/atheros/atlx/atl1.c index 98a4d08927..957d5598dd 100644 --- a/drivers/net/ethernet/atheros/atlx/atl1.c +++ b/drivers/net/ethernet/atheros/atlx/atl1.c @@ -2066,6 +2066,9 @@ static int atl1_intr_tx(struct atl1_adapter *adapter) sw_tpd_next_to_clean =3D atomic_read(&tpd_ring->next_to_clean); cmb_tpd_next_to_clean =3D le16_to_cpu(adapter->cmb.cmb->tpd_cons_idx); =20 + if (unlikely(cmb_tpd_next_to_clean >=3D tpd_ring->count)) + cmb_tpd_next_to_clean =3D sw_tpd_next_to_clean; + while (cmb_tpd_next_to_clean !=3D sw_tpd_next_to_clean) { buffer_info =3D &tpd_ring->buffer_info[sw_tpd_next_to_clean]; if (buffer_info->dma) { --=20 2.53.0