Re: [PATCH] usb: gadget: f_ncm: restart the TX timer if the TX freelist is empty

[Leonardo Costa]

On Mon, Aug 17, 2026 at 10:26:38PM +0300, Cosmin Tanislav wrote:
> ncm_wrap_ntb() aggregates datagrams into a pending NTB, which is sent
> either when it becomes full, or after 300us since the NTB was started,
> using ndo_start_xmit() (eth_start_xmit()).
> 
> ndo_start_xmit() returns NETDEV_TX_BUSY when the TX freelist is empty.
> 
> For regular packets this is fine since the networking core will requeue
> them, but for timer-flushed packets there is no logic to handle this
> situation, and HRTIMER_NORESTART is returned from ncm_tx_timeout()
> without checking eth_start_xmit()'s return value.
> 
> Under sustained TX saturation the request freelist is empty most of the
> time. Since the timer is never restarted, small packets keep getting
> accumulated into the NTB, until either TX_MAX_NUM_DPE packets are stored
> or NTB_DEFAULT_IN_SIZE is reached, which is an unknown amount of time.
> 
> Check the return value of ndo_start_xmit() and restart the timer after
> another 300us.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 6d3865f9d41f ("usb: gadget: NCM: Add transmit multi-frame.")
> Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@xxxxxxxxxxx>
> ---

Tested-by: Leonardo Costa <leonardo.costa@xxxxxxxxxxx>
Reported-by: Hiago De Franco <hiago.franco@xxxxxxxxxxx>
Closes: https://lore.kernel.org/all/20231204183751.64202-1-hiagofranco@xxxxxxxxx/