Commit 6bc8a509 authored by Sean Anderson's avatar Sean Anderson Committed by Jakub Kicinski
Browse files

net: macb: Fix tx_ptr_lock locking 



macb_start_xmit and macb_tx_poll can be called with bottom-halves
disabled (e.g. from softirq) as well as with interrupts disabled (with
netpoll). Because of this, all other functions taking tx_ptr_lock must
use spin_lock_irqsave.

Fixes: 138badbc ("net: macb: use NAPI for TX completion path")
Reported-by: default avatarMike Galbraith <efault@gmx.de>
Signed-off-by: default avatarSean Anderson <sean.anderson@linux.dev>
Link: https://patch.msgid.link/20250829143521.1686062-1-sean.anderson@linux.dev


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent b434a377

drivers/net/ethernet/cadence/macb_main.c

+16 −12
Original line number Diff line number Diff line
@@ -1223,12 +1223,13 @@ static int macb_tx_complete(struct macb_queue *queue, int budget) 
{

	struct macb *bp = queue->bp;

	u16 queue_index = queue - bp->queues;

	unsigned long flags;

	unsigned int tail;

	unsigned int head;

	int packets = 0;

	u32 bytes = 0;



	spin_lock(&queue->tx_ptr_lock);

	spin_lock_irqsave(&queue->tx_ptr_lock, flags);

	head = queue->tx_head;

	for (tail = queue->tx_tail; tail != head && packets < budget; tail++) {

		struct macb_tx_skb	*tx_skb;
@@ -1291,7 +1292,7 @@ static int macb_tx_complete(struct macb_queue *queue, int budget) 
	    CIRC_CNT(queue->tx_head, queue->tx_tail,

		     bp->tx_ring_size) <= MACB_TX_WAKEUP_THRESH(bp))

		netif_wake_subqueue(bp->dev, queue_index);

	spin_unlock(&queue->tx_ptr_lock);

	spin_unlock_irqrestore(&queue->tx_ptr_lock, flags);



	return packets;

}
@@ -1707,8 +1708,9 @@ static void macb_tx_restart(struct macb_queue *queue) 
{

	struct macb *bp = queue->bp;

	unsigned int head_idx, tbqp;

	unsigned long flags;



	spin_lock(&queue->tx_ptr_lock);

	spin_lock_irqsave(&queue->tx_ptr_lock, flags);



	if (queue->tx_head == queue->tx_tail)

		goto out_tx_ptr_unlock;
@@ -1720,19 +1722,20 @@ static void macb_tx_restart(struct macb_queue *queue) 
	if (tbqp == head_idx)

		goto out_tx_ptr_unlock;



	spin_lock_irq(&bp->lock);

	spin_lock(&bp->lock);

	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));

	spin_unlock_irq(&bp->lock);

	spin_unlock(&bp->lock);



out_tx_ptr_unlock:

	spin_unlock(&queue->tx_ptr_lock);

	spin_unlock_irqrestore(&queue->tx_ptr_lock, flags);

}



static bool macb_tx_complete_pending(struct macb_queue *queue)

{

	bool retval = false;

	unsigned long flags;



	spin_lock(&queue->tx_ptr_lock);

	spin_lock_irqsave(&queue->tx_ptr_lock, flags);

	if (queue->tx_head != queue->tx_tail) {

		/* Make hw descriptor updates visible to CPU */

		rmb();
@@ -1740,7 +1743,7 @@ static bool macb_tx_complete_pending(struct macb_queue *queue) 
		if (macb_tx_desc(queue, queue->tx_tail)->ctrl & MACB_BIT(TX_USED))

			retval = true;

	}

	spin_unlock(&queue->tx_ptr_lock);

	spin_unlock_irqrestore(&queue->tx_ptr_lock, flags);

	return retval;

}
@@ -2308,6 +2311,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	struct macb_queue *queue = &bp->queues[queue_index];

	unsigned int desc_cnt, nr_frags, frag_size, f;

	unsigned int hdrlen;

	unsigned long flags;

	bool is_lso;

	netdev_tx_t ret = NETDEV_TX_OK;
@@ -2368,7 +2372,7 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) 
		desc_cnt += DIV_ROUND_UP(frag_size, bp->max_tx_length);

	}



	spin_lock_bh(&queue->tx_ptr_lock);

	spin_lock_irqsave(&queue->tx_ptr_lock, flags);



	/* This is a hard error, log it. */

	if (CIRC_SPACE(queue->tx_head, queue->tx_tail,
@@ -2392,15 +2396,15 @@ static netdev_tx_t macb_start_xmit(struct sk_buff *skb, struct net_device *dev) 
	netdev_tx_sent_queue(netdev_get_tx_queue(bp->dev, queue_index),

			     skb->len);



	spin_lock_irq(&bp->lock);

	spin_lock(&bp->lock);

	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));

	spin_unlock_irq(&bp->lock);

	spin_unlock(&bp->lock);



	if (CIRC_SPACE(queue->tx_head, queue->tx_tail, bp->tx_ring_size) < 1)

		netif_stop_subqueue(dev, queue_index);



unlock:

	spin_unlock_bh(&queue->tx_ptr_lock);

	spin_unlock_irqrestore(&queue->tx_ptr_lock, flags);



	return ret;

}