Re: [PATCH net v2 2/4] net: macb: drop in-flight Tx SKBs on close

[Théo Lebrun]

Hello Nicolai,

On Tue Apr 28, 2026 at 11:30 PM CEST, Nicolai Buchwitz wrote:
> On 28.4.2026 18:32, Théo Lebrun wrote:
>> The MACB driver has since forever leaked the outgoing SKBs that
>> have not yet been marked as completed. They live in queue->tx_skb
>> which gets freed without remorse nor checking.
>> 
>> macb_free_consistent() gets called in a few codepaths, but only
>> close will trigger the added expressions. In macb_open() and
>> macb_alloc_consistent() failure cases, tx_skb just got allocated
>> and is empty.
>> 
>> Use the new macb_tx_unmap() prototype to report our error as
>> SKB_DROP_REASON_NOT_SPECIFIED rather than SKB_CONSUMED which makes it
>> sound like no error occurred. Equivalent to dev_kfree_skb_any().
>> 
>> Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Théo Lebrun <theo.lebrun@xxxxxxxxxxx>
>> ---
>>  drivers/net/ethernet/cadence/macb_main.c | 22 ++++++++++++++++++++--
>>  1 file changed, 20 insertions(+), 2 deletions(-)
>> 
>> diff --git a/drivers/net/ethernet/cadence/macb_main.c 
>> b/drivers/net/ethernet/cadence/macb_main.c
>> index 9caae1ef52b1..5a2500bd59a6 100644
>> --- a/drivers/net/ethernet/cadence/macb_main.c
>> +++ b/drivers/net/ethernet/cadence/macb_main.c
>> @@ -2678,8 +2678,26 @@ static void macb_free_consistent(struct macb 
>> *bp)
>>  	dma_free_coherent(dev, size, bp->queues[0].rx_ring, 
>> bp->queues[0].rx_ring_dma);
>> 
>>  	for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
>> -		kfree(queue->tx_skb);
>> -		queue->tx_skb = NULL;
>> +		if (queue->tx_skb) {
>> +			unsigned int dropped = 0, tail;
>> +
>> +			for (tail = queue->tx_tail; tail != queue->tx_head;
>> +			     tail++) {
>> +				if (macb_tx_skb(queue, tail)->skb)
>> +					dropped++;
>> +				macb_tx_unmap(bp, macb_tx_skb(queue, tail), 0,
>> +					      SKB_DROP_REASON_NOT_SPECIFIED);
>> +			}
>
> Reviewed-by: Nicolai Buchwitz <nb@xxxxxxxxxxx>

Thanks for the review!
We are quite a few caring about MACB which is nice.

> Side note, not blocking: macb_close() doesn't cancel tx_error_task,
> so the workqueue handler can race with this loop on tx_skb[]. The
> exposure is pre-existing, but maybe worth a follow-up adding
> cancel_work_sync() between napi_disable() and macb_free_consistent().

Yes, noticed that while working on the context swapping series [0].
The goal here is to improve MACB piecewise, so I won't take that on in
the current series.

[0]: https://lore.kernel.org/all/90f843aa3940bdbabadddce27314c1f1@xxxxxxxxxxx/t/#mda18f759c27a4d833084b23605463994632d97e3
     (and the two replies)

Thanks,

--
Théo Lebrun, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com