From 09f10efee6f93863ea71489ce84563f4d51787f6 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Tue, 27 Oct 2026 16:49:37 -0700 Subject: [PATCH] eth: bnxt: resize Rx head buffers when rx-copybreak changes Since rx-copybreak became configurable, bnxt_set_ring_params() sizes the head buffers to fit at least rx_copybreak bytes, and the copybreak path in bnxt_copy_data() syncs rx_copybreak bytes of the head buffer. bnxt_set_tunable() however only updates bp->rx_copybreak, and nothing on the open path recalculates the ring parameters. After raising rx-copybreak the head buffers keep their old size until some other setting changes, and bnxt_copy_data() syncs past their end, into the next buffer in the page or past the end of the page: DMA-API: bnxt_en 0000:01:00.0: device driver tries to sync DMA memory it has not allocated [device address=0x00000002aa210c40] [size=1024 bytes] WARNING: kernel/dma/debug.c:1162 at check_sync+0x577/0x1eb0, CPU#22: swapper/22/0 Call Trace: debug_dma_sync_single_for_cpu+0x66/0x90 bnxt_copy_data+0x12f/0x290 bnxt_rx_pkt+0x24ea/0x50f0 __bnxt_poll_work+0x42c/0xc00 bnxt_poll_p5+0x579/0x17a0 __napi_poll+0x8b/0x2c0 net_rx_action+0x58f/0xbb0 Here the head buffers were still sized for the 640B HDS threshold, four 1kB buffers per page, while rx-copybreak was raised to 1024. Without coherent DMA or with swiotlb the oversized sync can corrupt a neighboring buffer owned by the device or by an skb. The device must be down for rx-copybreak to change, so recalculate the ring parameters right away, like bnxt_set_ringparam() does. Hit while testing patch 1, tested on BCM57504 - boot; set rx-copybreak to 1024 with the link down (CONFIG_DMA_API_DEBUG); ifup. Fixes: 152f4da05aee ("bnxt_en: add support for rx-copybreak ethtool command") Reviewed-by: Michael Chan Link: https://patch.msgid.link/20261027234940.1267225-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index 622e89587e5d..ef4bea4a0f8c 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -4601,6 +4601,7 @@ static int bnxt_set_tunable(struct net_device *dev, if (netif_running(dev)) return -EBUSY; bp->rx_copybreak = rx_copybreak; + bnxt_set_ring_params(bp); } return 0; case ETHTOOL_PFC_PREVENTION_TOUT: