| From 3c9c54428e18f186d99ea4234ca07664f947edc0 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 23 Jul 2025 22:23:26 +0800 |
| Subject: stmmac: xsk: fix negative overflow of budget in zerocopy mode |
| |
| From: Jason Xing <kernelxing@tencent.com> |
| |
| [ Upstream commit 2764ab51d5f0e8c7d3b7043af426b1883e3bde1d ] |
| |
| A negative overflow can happen when the budget number of descs are |
| consumed. as long as the budget is decreased to zero, it will again go |
| into while (budget-- > 0) statement and get decreased by one, so the |
| overflow issue can happen. It will lead to returning true whereas the |
| expected value should be false. |
| |
| In this case where all the budget is used up, it means zc function |
| should return false to let the poll run again because normally we |
| might have more data to process. Without this patch, zc function would |
| return true instead. |
| |
| Fixes: 132c32ee5bc0 ("net: stmmac: Add TX via XDP zero-copy socket") |
| Signed-off-by: Jason Xing <kernelxing@tencent.com> |
| Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> |
| Link: https://patch.msgid.link/20250723142327.85187-2-kerneljasonxing@gmail.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
| index 1d716cee0cb1..77f800df6f37 100644 |
| --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
| +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |
| @@ -2585,7 +2585,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) |
| |
| budget = min(budget, stmmac_tx_avail(priv, queue)); |
| |
| - while (budget-- > 0) { |
| + for (; budget > 0; budget--) { |
| struct stmmac_metadata_request meta_req; |
| struct xsk_tx_metadata *meta = NULL; |
| dma_addr_t dma_addr; |
| -- |
| 2.39.5 |
| |
