diff mbox series

net: broadcom: bcm4908_enet: update TX stats after actual transmission

Message ID 20221027112430.8696-1-zajec5@gmail.com (mailing list archive)
State Accepted
Commit ef3556ee16c68735ec69bd08df41d1cd83b14ad3
Delegated to: Netdev Maintainers
Headers show
Series net: broadcom: bcm4908_enet: update TX stats after actual transmission | expand

Checks

Context Check Description
netdev/tree_selection success Guessed tree name to be net-next
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix warning Target tree name not specified in the subject
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers success CCed 7 of 7 maintainers
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 34 lines checked
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Rafał Miłecki Oct. 27, 2022, 11:24 a.m. UTC 
From: Rafał Miłecki <rafal@milecki.pl>

Queueing packets doesn't guarantee their transmission. Update TX stats
after hardware confirms consuming submitted data.

This also fixes a possible race and NULL dereference.
bcm4908_enet_start_xmit() could try to access skb after freeing it in
the bcm4908_enet_poll_tx().

Reported-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
---
This fixes a potential NULL dereference. It was never seen in real usage
though. I'm not sure if it makes this net-next or net material.
---
 drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

Comments

Florian Fainelli Oct. 27, 2022, 4:12 p.m. UTC | #1 
On 10/27/2022 4:24 AM, Rafał Miłecki wrote:
> From: Rafał Miłecki <rafal@milecki.pl>
> 
> Queueing packets doesn't guarantee their transmission. Update TX stats
> after hardware confirms consuming submitted data.
> 
> This also fixes a possible race and NULL dereference.
> bcm4908_enet_start_xmit() could try to access skb after freeing it in
> the bcm4908_enet_poll_tx().
> 
> Reported-by: Florian Fainelli <f.fainelli@gmail.com>
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>

To me this is 'net' material since it fixes a potential issue, but let's 
see what the netdev maintainers prefer.
Rafał Miłecki Oct. 27, 2022, 4:30 p.m. UTC | #2 
On 27.10.2022 18:12, Florian Fainelli wrote:
> On 10/27/2022 4:24 AM, Rafał Miłecki wrote:
>> From: Rafał Miłecki <rafal@milecki.pl>
>>
>> Queueing packets doesn't guarantee their transmission. Update TX stats
>> after hardware confirms consuming submitted data.
>>
>> This also fixes a possible race and NULL dereference.
>> bcm4908_enet_start_xmit() could try to access skb after freeing it in
>> the bcm4908_enet_poll_tx().
>>
>> Reported-by: Florian Fainelli <f.fainelli@gmail.com>
>> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
> 
> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
> 
> To me this is 'net' material since it fixes a potential issue, but let's see what the netdev maintainers prefer.

Thanks. In that case it may be also worth adding:

Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
patchwork-bot+netdevbpf@kernel.org Oct. 27, 2022, 5:40 p.m. UTC | #3 
Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 27 Oct 2022 13:24:30 +0200 you wrote:
> From: Rafał Miłecki <rafal@milecki.pl>
> 
> Queueing packets doesn't guarantee their transmission. Update TX stats
> after hardware confirms consuming submitted data.
> 
> This also fixes a possible race and NULL dereference.
> bcm4908_enet_start_xmit() could try to access skb after freeing it in
> the bcm4908_enet_poll_tx().
> 
> [...]

Here is the summary with links:
  - net: broadcom: bcm4908_enet: update TX stats after actual transmission
    https://git.kernel.org/netdev/net/c/ef3556ee16c6

You are awesome, thank you!
diff mbox series

Patch

diff --git a/drivers/net/ethernet/broadcom/bcm4908_enet.c b/drivers/net/ethernet/broadcom/bcm4908_enet.c
index ca8c86ee44c0..b0aac0bcb060 100644
--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
@@ -571,8 +571,6 @@  static netdev_tx_t bcm4908_enet_start_xmit(struct sk_buff *skb, struct net_devic
 
 	if (++ring->write_idx == ring->length - 1)
 		ring->write_idx = 0;
-	enet->netdev->stats.tx_bytes += skb->len;
-	enet->netdev->stats.tx_packets++;
 
 	return NETDEV_TX_OK;
 }
@@ -654,6 +652,7 @@  static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight)
 	struct bcm4908_enet_dma_ring_bd *buf_desc;
 	struct bcm4908_enet_dma_ring_slot *slot;
 	struct device *dev = enet->dev;
+	unsigned int bytes = 0;
 	int handled = 0;
 
 	while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
@@ -664,12 +663,17 @@  static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight)
 
 		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
 		dev_kfree_skb(slot->skb);
-		if (++tx_ring->read_idx == tx_ring->length)
-			tx_ring->read_idx = 0;
 
 		handled++;
+		bytes += slot->len;
+
+		if (++tx_ring->read_idx == tx_ring->length)
+			tx_ring->read_idx = 0;
 	}
 
+	enet->netdev->stats.tx_packets += handled;
+	enet->netdev->stats.tx_bytes += bytes;
+
 	if (handled < weight) {
 		napi_complete_done(napi, handled);
 		bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);