net: axienet: Fix race condition causing TX hang [Linux 4.4.187]

This Linux kernel change "net: axienet: Fix race condition causing TX hang" is included in the Linux 4.4.187 release. This change is authored by Robert Hancock <hancock [at]> on Thu Jun 6 16:28:17 2019 -0600. The commit for this change in Linux stable tree is 3746962 (patch) which is from upstream commit 7de4428. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 7de4428.

net: axienet: Fix race condition causing TX hang

[ Upstream commit 7de44285c1f69ccfbe8be1d6a16fcd956681fee6 ]

It is possible that the interrupt handler fires and frees up space in
the TX ring in between checking for sufficient TX ring space and
stopping the TX queue in axienet_start_xmit. If this happens, the
queue wake from the interrupt handler will occur before the queue is
stopped, causing a lost wakeup and the adapter's transmit hanging.

To avoid this, after stopping the queue, check again whether there is
sufficient space in the TX ring. If so, wake up the queue again.

Signed-off-by: Robert Hancock <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>

There are 20 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 58ba579..f1e9691 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -613,6 +613,10 @@ static void axienet_start_xmit_done(struct net_device *ndev)

    ndev->stats.tx_packets += packets;
    ndev->stats.tx_bytes += size;
+   /* Matches barrier in axienet_start_xmit */
+   smp_mb();

@@ -667,9 +671,19 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
    cur_p = &lp->tx_bd_v[lp->tx_bd_tail];

    if (axienet_check_tx_bd_space(lp, num_frag)) {
-       if (!netif_queue_stopped(ndev))
-           netif_stop_queue(ndev);
-       return NETDEV_TX_BUSY;
+       if (netif_queue_stopped(ndev))
+           return NETDEV_TX_BUSY;
+       netif_stop_queue(ndev);
+       /* Matches barrier in axienet_start_xmit_done */
+       smp_mb();
+       /* Space might have just been freed - check again */
+       if (axienet_check_tx_bd_space(lp, num_frag))
+           return NETDEV_TX_BUSY;
+       netif_wake_queue(ndev);

    if (skb->ip_summed == CHECKSUM_PARTIAL) {

Leave a Reply

Your email address will not be published. Required fields are marked *