[PATCH 0/3] net: atl1c/atl1e/atl1: fix soft lockup on out-of-range tx consumer index

[Gajdos Tamás]

atl1c_clean_tx() reads a hardware-maintained tx consumer index and
walks a software index towards it:

    while (next_to_clean != hw_next_to_clean) {
            ...
            if (++next_to_clean == tpd_ring->count)
                    next_to_clean = 0;
    }

next_to_clean only ever takes values in [0, tpd_ring->count). If the
hardware read returns a value outside that range - seen as 0xffff
while the PCIe link/MAC is resetting, e.g. during a neighboring
device's reboot - the loop condition can never become false, and the
NAPI thread spins forever. This produced a real soft lockup on
current hardware:

    watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0]
    RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]

Patch 1 fixes this in atl1c. atl1e and atl1 (atlx) share the exact
same loop shape, reading their own hardware-maintained consumer index
with no bounds check either, and are just as reachable from the same
kind of PCIe link event. Patches 2 and 3 apply the same guard to each.

Gajdos Tamás (3):
  net: atl1c: fix soft lockup on out-of-range tpd_cons read
  net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
  net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read

 drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 3 +++
 drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 3 +++
 drivers/net/ethernet/atheros/atlx/atl1.c        | 3 +++
 3 files changed, 9 insertions(+)

-- 
2.53.0