Commit ef3556ee authored by Rafał Miłecki's avatar Rafał Miłecki Committed by Jakub Kicinski
Browse files

net: broadcom: bcm4908_enet: update TX stats after actual transmission 



Queueing packets doesn't guarantee their transmission. Update TX stats
after hardware confirms consuming submitted data.

This also fixes a possible race and NULL dereference.
bcm4908_enet_start_xmit() could try to access skb after freeing it in
the bcm4908_enet_poll_tx().

Reported-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Fixes: 4feffead ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
Signed-off-by: default avatarRafał Miłecki <rafal@milecki.pl>
Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent bc520f5e

drivers/net/ethernet/broadcom/bcm4908_enet.c

+8 −4
Original line number Diff line number Diff line
@@ -561,8 +561,6 @@ static netdev_tx_t bcm4908_enet_start_xmit(struct sk_buff *skb, struct net_devic 


	if (++ring->write_idx == ring->length - 1)

		ring->write_idx = 0;

	enet->netdev->stats.tx_bytes += skb->len;

	enet->netdev->stats.tx_packets++;



	return NETDEV_TX_OK;

}
@@ -635,6 +633,7 @@ static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight) 
	struct bcm4908_enet_dma_ring_bd *buf_desc;

	struct bcm4908_enet_dma_ring_slot *slot;

	struct device *dev = enet->dev;

	unsigned int bytes = 0;

	int handled = 0;



	while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
@@ -645,12 +644,17 @@ static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight) 


		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);

		dev_kfree_skb(slot->skb);

		if (++tx_ring->read_idx == tx_ring->length)

			tx_ring->read_idx = 0;



		handled++;

		bytes += slot->len;



		if (++tx_ring->read_idx == tx_ring->length)

			tx_ring->read_idx = 0;

	}



	enet->netdev->stats.tx_packets += handled;

	enet->netdev->stats.tx_bytes += bytes;



	if (handled < weight) {

		napi_complete_done(napi, handled);

		bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);