Re: [PATCH net v2 3/6] net: bcm4908_enet: release the TX ring on stop

[Kordian Chmielewski]

On Fri, 13 Nov 2026 20:42:08 +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> - [High] Double free and double DMA unmap of TX skbs, introduced by the
>   new bcm4908_enet_tx_ring_clean().

Right. It happens when an open() between two stop() calls fails to fill
the RX ring: bcm4908_enet_open() ignores that error, the TX ring is not
reset, and the second stop() frees the same skbs again. In v3,
bcm4908_enet_tx_ring_clean() leaves the ring empty. I'll fix the
ignored error in open() separately.

> - [Medium] bcm4908_enet_stop() now frees in-flight TX buffers even when
>   the TX DMA channel was never confirmed stopped.

Also right, and with HZ=250 the 2 ms deadline can expire after one
poll. In v3 the wait uses read_poll_timeout(), and when the channel
does not stop, stop() leaves the skbs alone, as before this patch.

> Pre-existing issues:
> - [High] This problem wasn't introduced by this patch, but it is High
>   severity and it stops the patch's new cleanup from ever running in…

That's the missing TX interrupt; I've answered it under patch 1.

pw-bot: cr