net: ti: icssg-prueth: Fix kernel panic during concurrent Tx queue access

Add __netif_tx_lock() to ensure that only one packet is being
transmitted at a time to avoid race conditions in the netif_txq
struct and prevent packet data corruption. Failing to do so causes
kernel panic with the following error:

[ 2184.746764] ------------[ cut here ]------------
[ 2184.751412] kernel BUG at lib/dynamic_queue_limits.c:99!
[ 2184.756728] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP

logs: https://gist.github.com/MeghanaMalladiTI/9c7aa5fc3b7fb03f87c74aad487956e9

The lock is acquired before calling emac_xmit_xdp_frame() and released after the
call returns. This ensures that the TX queue is protected from concurrent access
during the transmission of XDP frames.

Fixes: 62aa3246f462 ("net: ti: icssg-prueth: Add XDP support")
Signed-off-by: Meghana Malladi <m-malladi@ti.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20250506110546.4065715-3-m-malladi@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/ti/icssg/icssg_common.c b/drivers/net/ethernet/ti/icssg/icssg_common.c
index b4be76e13a2fb74ae707f1a9a135f70bc44e3f42..38a80e004d1cf2f5f875b4a1145f554ffdadc386 100644 (file)
--- a/drivers/net/ethernet/ti/icssg/icssg_common.c
+++ b/drivers/net/ethernet/ti/icssg/icssg_common.c
@@ -650,6 +650,8 @@ static u32 emac_run_xdp(struct prueth_emac *emac, struct xdp_buff *xdp,
                        struct page *page, u32 *len)
 {
        struct net_device *ndev = emac->ndev;
+       struct netdev_queue *netif_txq;
+       int cpu = smp_processor_id();
        struct bpf_prog *xdp_prog;
        struct xdp_frame *xdpf;
        u32 pkt_len = *len;
@@ -669,8 +671,11 @@ static u32 emac_run_xdp(struct prueth_emac *emac, struct xdp_buff *xdp,
                        goto drop;
                }
 
-               q_idx = smp_processor_id() % emac->tx_ch_num;
+               q_idx = cpu % emac->tx_ch_num;
+               netif_txq = netdev_get_tx_queue(ndev, q_idx);
+               __netif_tx_lock(netif_txq, cpu);
                result = emac_xmit_xdp_frame(emac, xdpf, page, q_idx);
+               __netif_tx_unlock(netif_txq);
                if (result == ICSSG_XDP_CONSUMED) {
                        ndev->stats.tx_dropped++;
                        goto drop;

diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.c b/drivers/net/ethernet/ti/icssg/icssg_prueth.c
index ee35fecf61e7c6fc2acd7d84d03dd7910f7862a8..86fc1278127c74e83a640dc6467f5455c250c659 100644 (file)
--- a/drivers/net/ethernet/ti/icssg/icssg_prueth.c
+++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.c
@@ -1075,17 +1075,21 @@ static int emac_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frame
 {
        struct prueth_emac *emac = netdev_priv(dev);
        struct net_device *ndev = emac->ndev;
+       struct netdev_queue *netif_txq;
+       int cpu = smp_processor_id();
        struct xdp_frame *xdpf;
        unsigned int q_idx;
        int nxmit = 0;
        u32 err;
        int i;
 
-       q_idx = smp_processor_id() % emac->tx_ch_num;
+       q_idx = cpu % emac->tx_ch_num;
+       netif_txq = netdev_get_tx_queue(ndev, q_idx);
 
        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
                return -EINVAL;
 
+       __netif_tx_lock(netif_txq, cpu);
        for (i = 0; i < n; i++) {
                xdpf = frames[i];
                err = emac_xmit_xdp_frame(emac, xdpf, NULL, q_idx);
@@ -1095,6 +1099,7 @@ static int emac_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frame
                }
                nxmit++;
        }
+       __netif_tx_unlock(netif_txq);
 
        return nxmit;
 }