linux-kernel - RE: [Intel-wired-lan] [PATCH v2] idpf: increment completion queue next_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <IA3PR11MB898683A1383A409E8C4B02F6E586A@IA3PR11MB8986.namprd11.prod.outlook.com>
Date: Mon, 5 Jan 2026 07:19:13 +0000
From: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
To: Li Li <boolli@...gle.com>, "Nguyen, Anthony L"
	<anthony.l.nguyen@...el.com>, "Kitszel, Przemyslaw"
	<przemyslaw.kitszel@...el.com>, "David S. Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Eric Dumazet <edumazet@...gle.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "David
 Decotigny" <decot@...gle.com>, "Singhai, Anjali" <anjali.singhai@...el.com>,
	"Samudrala, Sridhar" <sridhar.samudrala@...el.com>, Brian Vazquez
	<brianvv@...gle.com>, "Tantilov, Emil S" <emil.s.tantilov@...el.com>
Subject: RE: [Intel-wired-lan] [PATCH v2] idpf: increment completion queue
 next_to_clean in sw marker wait routine



> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf
> Of Li Li via Intel-wired-lan
> Sent: Monday, January 5, 2026 7:47 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@...el.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@...el.com>; David S. Miller
> <davem@...emloft.net>; Jakub Kicinski <kuba@...nel.org>; Eric Dumazet
> <edumazet@...gle.com>; intel-wired-lan@...ts.osuosl.org
> Cc: netdev@...r.kernel.org; linux-kernel@...r.kernel.org; David
> Decotigny <decot@...gle.com>; Singhai, Anjali
> <anjali.singhai@...el.com>; Samudrala, Sridhar
> <sridhar.samudrala@...el.com>; Brian Vazquez <brianvv@...gle.com>;
> Tantilov, Emil S <emil.s.tantilov@...el.com>; Li Li
> <boolli@...gle.com>
> Subject: [Intel-wired-lan] [PATCH v2] idpf: increment completion queue
> next_to_clean in sw marker wait routine
> 
> Currently, in idpf_wait_for_sw_marker_completion(), when an
> IDPF_TXD_COMPLT_SW_MARKER packet is found, the routine breaks out of
> the for loop and does not increment the next_to_clean counter. This
> causes the subsequent NAPI polls to run into the same
> IDPF_TXD_COMPLT_SW_MARKER packet again and print out the following:
> 
>     [   23.261341] idpf 0000:05:00.0 eth1: Unknown TX completion type:
> 5
> 
> Instead, we should increment next_to_clean regardless when an
> IDPF_TXD_COMPLT_SW_MARKER packet is found.
> 
> Tested: with the patch applied, we do not see the errors above from
> NAPI polls anymore.
> 
> Signed-off-by: Li Li <boolli@...gle.com>
> ---
> Changes in v2:
>  - Initialize idpf_tx_queue *target to NULL to suppress the "'target'
>    uninitialized when 'if' statement is true warning".
> 
>  drivers/net/ethernet/intel/idpf/idpf_txrx.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> index 69bab7187e541..452d0a9e83a4f 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> @@ -2326,7 +2326,7 @@ void idpf_wait_for_sw_marker_completion(const
> struct idpf_tx_queue *txq)
> 
>  	do {
>  		struct idpf_splitq_4b_tx_compl_desc *tx_desc;
> -		struct idpf_tx_queue *target;
> +		struct idpf_tx_queue *target = NULL;
Linux kernel is against premature initialization just to silence a compiler.
The target variable is dereferenced at idpf_queue_clear(SW_MARKER, target))
but can remain uninitialized if execution jumps to the next: label via a goto
before target is assigned.
Isn't it?

>  		u32 ctype_gen, id;
> 
>  		tx_desc = flow ? &complq->comp[ntc].common :
> @@ -2346,14 +2346,14 @@ void idpf_wait_for_sw_marker_completion(const
> struct idpf_tx_queue *txq)
>  		target = complq->txq_grp->txqs[id];
> 
>  		idpf_queue_clear(SW_MARKER, target);
> -		if (target == txq)
> -			break;
> 
>  next:
>  		if (unlikely(++ntc == complq->desc_count)) {
>  			ntc = 0;
>  			gen_flag = !gen_flag;
>  		}
> +		if (target == txq)
Are tou sure that incremented ntc value is ever written back to complq->next_to_clean?

> +			break;
>  	} while (time_before(jiffies, timeout));
> 
>  	idpf_queue_assign(GEN_CHK, complq, gen_flag);
> --
> 2.52.0.351.gbe84eed79e-goog