From c5faf1d4df8f5be608267dfa87cc819dde0bef97 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Mon, 14 Sep 2026 23:26:42 +0200 Subject: [PATCH] net: ethernet: cortina: Bound RX descriptor processing NAPI budgets received packets, so gmac_rx() only consumes budget when an EOF descriptor completes a frame. A malformed descriptor stream without EOF can consequently make one poll consume the entire snapshotted RX ring, which may contain up to 32768 descriptors. The error paths can also flood the kernel log while doing so. Keep the packet budget EOF-based, but impose a separate descriptor limit which allows MAX_SKB_FRAGS descriptors for every packet in the budget. If the limit is reached with descriptors still pending, return the full NAPI budget to retain ownership and continue in another poll. Ratelimit errors reported from malformed descriptor paths. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260914-b4-gemini-ethernet-fixes-2-v2-2-5ab39a047b90@kernel.org Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/cortina/gemini.c | 32 ++++++++++++++++++--------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c index f08de623e6f7..663d2ce8414f 100644 --- a/drivers/net/ethernet/cortina/gemini.c +++ b/drivers/net/ethernet/cortina/gemini.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include @@ -736,7 +737,8 @@ gmac_get_queue_page(struct gemini_ethernet *geth, mapping = addr & PAGE_MASK; if (!geth->freeq_pages) { - dev_err(geth->dev, "try to get page with no page list\n"); + dev_err_ratelimited(geth->dev, + "try to get page with no page list\n"); return NULL; } @@ -1441,7 +1443,7 @@ static struct sk_buff *gmac_skb_if_good_frame(struct gemini_ethernet_port *port, } static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget, - unsigned int *freeq_consumed) + unsigned int *freeq_consumed, bool *reschedule) { struct gemini_ethernet_port *port = netdev_priv(netdev); unsigned short m = (1 << port->rxq_order) - 1; @@ -1449,6 +1451,8 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget, void __iomem *ptr_reg = port->rxq_rwptr; unsigned int frag_nr = port->rx_frag_nr; struct sk_buff *skb = port->rx_skb; + /* Bound malformed chains while allowing maximum fragments per frame. */ + unsigned int desc_limit = budget * MAX_SKB_FRAGS; unsigned int consumed = 0; unsigned int frame_len, frag_len; struct gmac_rxdesc *rx = NULL; @@ -1475,7 +1479,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget, r = rw.bits.rptr; w = rw.bits.wptr; - while (budget && w != r) { + while (budget && consumed < desc_limit && w != r) { page = NULL; rx = port->rxq_ring + r; word0 = rx->word0; @@ -1502,15 +1506,18 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget, } if (!mapping) { - netdev_err(netdev, - "rxq[%u]: HW BUG: zero DMA desc\n", r); + if (net_ratelimit()) + netdev_err(netdev, + "rxq[%u]: HW BUG: zero DMA desc\n", + r); goto err_drop; } /* Freeq pointers are one page off */ gpage = gmac_get_queue_page(geth, port, mapping + PAGE_SIZE); if (!gpage) { - dev_err(geth->dev, "could not find mapping\n"); + dev_err_ratelimited(geth->dev, + "could not find mapping\n"); goto err_drop; } page = gpage->page; @@ -1535,7 +1542,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget, if (frag_nr == MAX_SKB_FRAGS) goto err_drop; - if (frag_len == 0) + if (frag_len == 0 && net_ratelimit()) netdev_err(netdev, "Received fragment with len = 0\n"); skb_fill_page_desc(skb, frag_nr, page, page_offs, frag_len); @@ -1579,6 +1586,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget, port->rx_frag_nr = frag_nr; port->rx_dropping = dropping; *freeq_consumed = consumed; + *reschedule = budget && w != r; writew(r, ptr_reg); return received; } @@ -1590,12 +1598,13 @@ static int gmac_napi_poll(struct napi_struct *napi, int budget) unsigned int freeq_threshold; unsigned int freeq_consumed; unsigned int received; + bool reschedule; freeq_threshold = 1 << (geth->freeq_order - 1); u64_stats_update_begin(&port->rx_stats_syncp); - received = gmac_rx(napi->dev, budget, &freeq_consumed); - if (received < budget) + received = gmac_rx(napi->dev, budget, &freeq_consumed, &reschedule); + if (!reschedule && received < budget) ++port->rx_napi_exits; u64_stats_update_end(&port->rx_stats_syncp); @@ -1606,10 +1615,11 @@ static int gmac_napi_poll(struct napi_struct *napi, int budget) geth_fill_freeq(geth, true); } - if (received < budget && napi_complete_done(napi, received)) + if (!reschedule && received < budget && + napi_complete_done(napi, received)) gmac_enable_rx_irq(napi->dev, 1); - return received; + return reschedule ? budget : received; } static void gmac_dump_dma_state(struct net_device *netdev)