FAILED: patch "[PATCH] bnxt_en: Don't free the live ring's TPA state on queue" failed to apply to 6.12-stable tree
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 5ce7f36c334d723954855ac769ede2fe0e8f89c8
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091604-recall-carnivore-5fe5@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5ce7f36c334d723954855ac769ede2fe0e8f89c8 Mon Sep 17 00:00:00 2001
From: Joe Damato <[email protected]>
Date: Tue, 1 Sep 2026 18:56:45 -0700
Subject: [PATCH] bnxt_en: Don't free the live ring's TPA state on queue
restart failure
bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:
memcpy(clone, rxr, sizeof(*rxr));
the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned.
If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use.
Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -0
@@ -16357,6 +16357,8 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, clone->need_head_pool = false; clone->rx_page_size = qcfg->rx_page_size; clone->rx_agg_bmap =NULL ; + clone->rx_tpa =NULL ; + clone->rx_tpa_idx_map =NULL ; rc =bnxt_alloc_rx_page_pool (bp, clone, rxr->page_pool->p.nid);if (rc)
Sasha Levin
maintainerPATCH 1/4 bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
From: Michael Chan <[email protected]>
[ Upstream commit 30f253f8d9a01d532fdb7ec6c8a9d4c15fe29241 ]
With End-of-Packet padding (EOP) set, the chip will disable Relaxed Ordering (RO) of TPA data packets. A TPA segment with EOP set will be padded to the next cache boundary and can potentially overwrite the beginning bytes of the next TPA segment when RO is enabled on 5760X. To prevent that, the chip disables RO for TPA when EOP is set.
To take advantge of RO and higher performance, do not set EOP on 5760X chips when TPA is enabled. Define a proper RX_BD_FLAGS_AGG_EOP constant to make it clear that we are setting EOP.
Stable-dep-of: 5ce7f36c334d ("bnxt_en: Don't free the live ring's TPA state on queue restart failure")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 ++++++++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +8 -1
@@ -4300,7 +4300,14 @@ static void bnxt_init_one_rx_agg_ring_rxbd(struct bnxt *bp, ring->fw_ring_id =INVALID_HW_RING_ID ;if ((bp->flags &BNXT_FLAG_AGG_RINGS )) { type = ((u32 )BNXT_RX_PAGE_SIZE <<RX_BD_LEN_SHIFT ) | -RX_BD_TYPE_RX_AGG_BD |RX_BD_FLAGS_SOP ; +RX_BD_TYPE_RX_AGG_BD ; + +/* On P7, setting EOP will cause the chip to disable +* Relaxed Ordering (RO) for TPA data. Disable EOP for +* potentially higher performance with RO. +*/ +if (BNXT_CHIP_P5_AND_MINUS (bp) || !(bp->flags &BNXT_FLAG_TPA )) + type |=RX_BD_FLAGS_AGG_EOP ;bnxt_init_rxbd_pages (ring, type); }
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -124,6 +124,7 @@ struct rx_bd {#define RX_BD_TYPE_48B_BD_SIZE (2 << 4)#define RX_BD_TYPE_64B_BD_SIZE (3 << 4)#define RX_BD_FLAGS_SOP (1 << 6) +#define RX_BD_FLAGS_AGG_EOP (1 << 6)#define RX_BD_FLAGS_EOP (1 << 7)#define RX_BD_FLAGS_BUFFERS (3 << 8)#define RX_BD_FLAGS_1_BUFFER_PACKET (0 << 8)
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/4 eth: bnxt: store rx buffer size per queue
From: Pavel Begunkov <[email protected]>
[ Upstream commit f57efb32aae1da5c0a25acf473ef4ab559894adf ]
Instead of using a constant buffer length, allow configuring the size for each queue separately. There is no way to change the length yet, and it'll be passed from memory providers in a later patch.
Stable adaptation for 6.12:
Keep the per-queue buffer size change using the existing page-based RX and XDP interfaces. Apply aggregation truesize accounting in bnxt_rx_agg_pages_skb(), and program the size in the existing firmware ring allocation path instead of adding the newer helper functions.
This tree has no unreadable netmem pools. Derive head-pool separation from the queue buffer size, keep head allocations at order zero, and use the same queue-specific decision for allocation and cleanup. Keep the existing pool sizing and NAPI association. Queue sizes start at BNXT_RX_PAGE_SIZE and are inherited by restart clones.
Initialize the clone's rx_agg_bmap to NULL to separate it from the live ring and provide the common initialization context needed to cherry-pick 5ce7f36c334d ("bnxt_en: Don't free the live ring's TPA state on queue restart failure") cleanly. The target's TPA pointer resets are left to that commit. No functions are added.
Stable-dep-of: 5ce7f36c334d ("bnxt_en: Don't free the live ring's TPA state on queue restart failure")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 60 +++++++++++-------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h | 2 +- 4 files changed, 39 insertions(+), 30 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +34 -26
@@ -867,9 +867,9 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) bnapi->events &= ~BNXT_TX_CMP_EVENT ; } -static bool bnxt_separate_head_pool (void ) +static bool bnxt_separate_head_pool (struct bnxt_rx_ring_info *rxr) { -return PAGE_SIZE >BNXT_RX_PAGE_SIZE ; +return rxr->rx_page_size !=PAGE_SIZE ; } static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping,
@@ -879,9 +879,9 @@ static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, {struct page *page; -if (PAGE_SIZE >BNXT_RX_PAGE_SIZE ) { +if (rxr->rx_page_size <PAGE_SIZE ) { page =page_pool_dev_alloc_frag (rxr->page_pool, offset, -BNXT_RX_PAGE_SIZE ); + rxr->rx_page_size); }else { page =page_pool_dev_alloc_pages (rxr->page_pool); *offset =0 ;
@@ -1101,9 +1101,9 @@ static struct sk_buff *bnxt_rx_multi_page_skb(struct bnxt *bp,return NULL ; } dma_addr -= bp->rx_dma_offset; -dma_sync_single_for_cpu (&bp->pdev->dev, dma_addr,BNXT_RX_PAGE_SIZE , +dma_sync_single_for_cpu (&bp->pdev->dev, dma_addr, rxr->rx_page_size, bp->rx_dir); - skb =napi_build_skb (data_ptr - bp->rx_offset,BNXT_RX_PAGE_SIZE ); + skb =napi_build_skb (data_ptr - bp->rx_offset, rxr->rx_page_size);if (!skb) {page_pool_recycle_direct (rxr->page_pool, page);return NULL ;
@@ -1135,7 +1135,7 @@ static struct sk_buff *bnxt_rx_page_skb(struct bnxt *bp,return NULL ; } dma_addr -= bp->rx_dma_offset; -dma_sync_single_for_cpu (&bp->pdev->dev, dma_addr,BNXT_RX_PAGE_SIZE , +dma_sync_single_for_cpu (&bp->pdev->dev, dma_addr, rxr->rx_page_size, bp->rx_dir);if (unlikely (!payload))
@@ -1149,7 +1149,7 @@ static struct sk_buff *bnxt_rx_page_skb(struct bnxt *bp,skb_mark_for_recycle (skb); off = (void *)data_ptr -page_address (page); -skb_add_rx_frag (skb,0 , page, off, len,BNXT_RX_PAGE_SIZE ); +skb_add_rx_frag (skb,0 , page, off, len, rxr->rx_page_size);memcpy (skb->data -NET_IP_ALIGN , data_ptr -NET_IP_ALIGN , payload +NET_IP_ALIGN );
@@ -1253,7 +1253,7 @@ static u32 __bnxt_rx_agg_pages(struct bnxt *bp,return 0 ; } -dma_sync_single_for_cpu (&pdev->dev, mapping,BNXT_RX_PAGE_SIZE , +dma_sync_single_for_cpu (&pdev->dev, mapping, rxr->rx_page_size, bp->rx_dir); total_frag_len += frag_len;
@@ -1268,6 +1268,7 @@ static struct sk_buff *bnxt_rx_agg_pages_skb(struct bnxt *bp, struct sk_buff *skb, u16 idx, u32 agg_bufs, bool tpa) { + struct bnxt_rx_ring_info *rxr = cpr->bnapi->rx_ring;struct skb_shared_info *shinfo =skb_shinfo (skb);u32 total_frag_len =0 ;
@@ -1281,7 +1282,7 @@ static struct sk_buff *bnxt_rx_agg_pages_skb(struct bnxt *bp, skb->data_len += total_frag_len; skb->len += total_frag_len; - skb->truesize +=BNXT_RX_PAGE_SIZE * agg_bufs; + skb->truesize += rxr->rx_page_size * agg_bufs;return skb; }
@@ -2222,8 +2223,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,if (!skb) goto oom_next_rx; }else { - skb =bnxt_xdp_build_skb (bp, skb, agg_bufs, - rxr->page_pool, &xdp); + skb =bnxt_xdp_build_skb (bp, skb, agg_bufs, rxr, &xdp);if (!skb) {/* we should be able to free the old skb here */ bnxt_xdp_buff_frags_free (rxr, &xdp);
@@ -3647,7 +3647,7 @@ static void bnxt_free_rx_rings(struct bnxt *bp)xdp_rxq_info_unreg (&rxr->xdp_rxq);page_pool_destroy (rxr->page_pool); -if (bnxt_separate_head_pool ()) +if (bnxt_separate_head_pool (rxr))page_pool_destroy (rxr->head_pool); rxr->page_pool = rxr->head_pool =NULL ;
@@ -3672,12 +3672,14 @@ static int bnxt_alloc_rx_page_pool(struct bnxt *bp, pp.pool_size = bp->rx_agg_ring_size;if (BNXT_RX_PAGE_MODE (bp)) pp.pool_size += bp->rx_ring_size; + + pp.order =get_order (rxr->rx_page_size); pp.nid = numa_node; pp.napi = &rxr->bnapi->napi; pp.netdev = bp->dev; pp.dev = &bp->pdev->dev; pp.dma_dir = bp->rx_dir; - pp.max_len =PAGE_SIZE ; + pp.max_len =PAGE_SIZE << pp.order; pp.flags =PP_FLAG_DMA_MAP |PP_FLAG_DMA_SYNC_DEV ; pool =page_pool_create (&pp);
@@ -3685,7 +3687,9 @@ static int bnxt_alloc_rx_page_pool(struct bnxt *bp,return PTR_ERR (pool); rxr->page_pool = pool; -if (bnxt_separate_head_pool ()) { +if (bnxt_separate_head_pool (rxr)) { + pp.order =0 ; + pp.max_len =PAGE_SIZE ; pp.pool_size =max (bp->rx_ring_size,1024 ); pool =page_pool_create (&pp);if (IS_ERR (pool))
@@ -4140,6 +4144,8 @@ static void bnxt_init_ring_struct(struct bnxt *bp)if (!rxr) goto skip_rx; + rxr->rx_page_size =BNXT_RX_PAGE_SIZE ; + ring = &rxr->rx_ring_struct; rmem = &ring->ring_mem; rmem->nr_pages = bp->rx_nr_pages;
@@ -4299,7 +4305,7 @@ static void bnxt_init_one_rx_agg_ring_rxbd(struct bnxt *bp, ring = &rxr->rx_agg_ring_struct; ring->fw_ring_id =INVALID_HW_RING_ID ;if ((bp->flags &BNXT_FLAG_AGG_RINGS )) { - type = ((u32 )BNXT_RX_PAGE_SIZE <<RX_BD_LEN_SHIFT ) | + type = ((u32 )rxr->rx_page_size <<RX_BD_LEN_SHIFT ) |RX_BD_TYPE_RX_AGG_BD ;/* On P7, setting EOP will cause the chip to disable
@@ -6864,6 +6870,7 @@ static void bnxt_hwrm_ring_grp_free(struct bnxt *bp) }static int hwrm_ring_alloc_send_msg (struct bnxt *bp, +struct bnxt_rx_ring_info *rxr,struct bnxt_ring_struct *ring,u32 ring_type,u32 map_index) {
@@ -6936,7 +6943,7 @@ static int hwrm_ring_alloc_send_msg(struct bnxt *bp,/* Association of agg ring with rx ring */ grp_info = &bp->grp_info[ring->grp_idx]; req->rx_ring_id =cpu_to_le16 (grp_info->rx_fw_ring_id); - req->rx_buf_size =cpu_to_le16 (BNXT_RX_PAGE_SIZE ); + req->rx_buf_size =cpu_to_le16 (rxr->rx_page_size); req->stat_ctx_id =cpu_to_le32 (grp_info->fw_stats_ctx); req->enables |= cpu_to_le32( RING_ALLOC_REQ_ENABLES_RX_RING_ID_VALID |
@@ -7092,7 +7099,7 @@ static int bnxt_hwrm_rx_ring_alloc(struct bnxt *bp,u32 map_idx = bnapi->index;int rc; - rc =hwrm_ring_alloc_send_msg (bp, ring, type, map_idx); + rc =hwrm_ring_alloc_send_msg (bp, rxr, ring, type, map_idx);if (rc)return rc;
@@ -7112,7 +7119,7 @@ static int bnxt_hwrm_rx_agg_ring_alloc(struct bnxt *bp,int rc; map_idx = grp_idx + bp->rx_nr_rings; - rc =hwrm_ring_alloc_send_msg (bp, ring, type, map_idx); + rc =hwrm_ring_alloc_send_msg (bp, rxr, ring, type, map_idx);if (rc)return rc;
@@ -7144,7 +7151,7 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp) vector = bp->irq_tbl[map_idx].vector;disable_irq_nosync (vector); - rc =hwrm_ring_alloc_send_msg (bp, ring, type, map_idx); + rc =hwrm_ring_alloc_send_msg (bp,NULL , ring, type, map_idx);if (rc) {enable_irq (vector); goto err_out;
@@ -7175,7 +7182,7 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp) ring = &cpr2->cp_ring_struct; ring->handle =BNXT_SET_NQ_HDL (cpr2); map_idx = bnapi->index; - rc =hwrm_ring_alloc_send_msg (bp, ring, type2, map_idx); + rc =hwrm_ring_alloc_send_msg (bp,NULL , ring, type2, map_idx);if (rc) goto err_out; bnxt_set_db(bp, &cpr2->cp_db, type2, map_idx,
@@ -7184,7 +7191,7 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp) } ring = &txr->tx_ring_struct; map_idx = i; - rc =hwrm_ring_alloc_send_msg (bp, ring, type, map_idx); + rc =hwrm_ring_alloc_send_msg (bp,NULL , ring, type, map_idx);if (rc) goto err_out;bnxt_set_db (bp, &txr->tx_db, type, map_idx, ring->fw_ring_id);
@@ -7208,7 +7215,7 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp) ring = &cpr2->cp_ring_struct; ring->handle =BNXT_SET_NQ_HDL (cpr2); - rc =hwrm_ring_alloc_send_msg (bp, ring, type2, map_idx); + rc =hwrm_ring_alloc_send_msg (bp,NULL , ring, type2, map_idx);if (rc) goto err_out; bnxt_set_db(bp, &cpr2->cp_db, type2, map_idx,
@@ -15381,6 +15388,7 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx) clone->rx_agg_prod =0 ; clone->rx_sw_agg_prod =0 ; clone->rx_next_cons =0 ; + clone->rx_agg_bmap =NULL ; rc =bnxt_alloc_rx_page_pool (bp, clone, rxr->page_pool->p.nid);if (rc)
@@ -15439,7 +15447,7 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx)xdp_rxq_info_unreg (&clone->xdp_rxq); err_page_pool_destroy:page_pool_destroy (clone->page_pool); -if (bnxt_separate_head_pool ()) +if (bnxt_separate_head_pool (clone))page_pool_destroy (clone->head_pool); clone->page_pool =NULL ; clone->head_pool =NULL ;
@@ -15458,7 +15466,7 @@ static void bnxt_queue_mem_free(struct net_device *dev, void *qmem)xdp_rxq_info_unreg (&rxr->xdp_rxq);page_pool_destroy (rxr->page_pool); -if (bnxt_separate_head_pool ()) +if (bnxt_separate_head_pool (rxr))page_pool_destroy (rxr->head_pool); rxr->page_pool =NULL ; rxr->head_pool =NULL ;
@@ -15602,7 +15610,7 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx)bnxt_hwrm_rx_agg_ring_free (bp, rxr, false); rxr->rx_next_cons =0 ;page_pool_disable_direct_recycling (rxr->page_pool); -if (bnxt_separate_head_pool ()) +if (bnxt_separate_head_pool (rxr))page_pool_disable_direct_recycling (rxr->head_pool);memcpy (qmem, rxr,sizeof (*rxr));
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -1098,6 +1098,7 @@ struct bnxt_rx_ring_info {unsigned long *rx_agg_bmap;u16 rx_agg_bmap_size; +u32 rx_page_size;dma_addr_t rx_desc_mapping[MAX_RX_PAGES ];dma_addr_t rx_agg_desc_mapping[MAX_RX_AGG_PAGES ];
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +3 -3
@@ -182,7 +182,7 @@ void bnxt_xdp_buff_init(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, u16 cons, u8 *data_ptr, unsigned int len, struct xdp_buff *xdp) { - u32 buflen = BNXT_RX_PAGE_SIZE; + u32 buflen = rxr->rx_page_size;struct bnxt_sw_rx_bd *rx_buf;struct pci_dev *pdev;dma_addr_t mapping;
@@ -454,7 +454,7 @@ int bnxt_xdp(struct net_device *dev, struct netdev_bpf *xdp)struct sk_buff *bnxt_xdp_build_skb (struct bnxt *bp,struct sk_buff *skb,u8 num_frags, -struct page_pool *pool,struct xdp_buff *xdp) +struct bnxt_rx_ring_info *rxr,struct xdp_buff *xdp) {struct skb_shared_info *sinfo =xdp_get_shared_info_from_buff (xdp);
@@ -463,7 +463,7 @@ bnxt_xdp_build_skb(struct bnxt *bp, struct sk_buff *skb, u8 num_frags,xdp_update_skb_shared_info (skb, num_frags, sinfo->xdp_frags_size, -BNXT_RX_PAGE_SIZE * num_frags, + rxr->rx_page_size * num_frags,xdp_buff_is_frag_pfmemalloc (xdp));return skb; }
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h +1 -1
@@ -32,6 +32,6 @@ void bnxt_xdp_buff_init(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,void bnxt_xdp_buff_frags_free (struct bnxt_rx_ring_info *rxr,struct xdp_buff *xdp);struct sk_buff *bnxt_xdp_build_skb (struct bnxt *bp,struct sk_buff *skb, -u8 num_frags,struct page_pool *pool, +u8 num_frags,struct bnxt_rx_ring_info *rxr,struct xdp_buff *xdp);#endif
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/4 bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
In reply to Sasha LevinFrom: Will Chen <[email protected]>
[ Upstream commit d1000fd7995e51deec872d154e0a40d82f7a539f ]
There is a small memory leak in bnxt_queue_mem_alloc:
when bnxt_alloc_rx_agg_bmap() succeeds
but bnxt_alloc_one_tpa_info() later fails, the rx_agg_bmap allocated by bnxt_alloc_rx_agg_bmap() is not freed in the fallthrough cleanup cases.
Free the rx_agg_bmap in the err_free_rx_agg_ring case and initialize clone->rx_agg_bmap = NULL earlier in the function to allow for safe fallthrough.
Stable adaptation for 6.12:
The preceding per-queue buffer-size backport already initializes the clone's rx_agg_bmap to NULL. Retain that initialization and apply the missing bitmap cleanup to err_free_rx_agg_ring. This frees the clone's bitmap when TPA allocation fails, while earlier allocation failures can safely fall through with a NULL bitmap.
Keep the existing queue allocation interface and inherited RX page
size: this tree has neither qcfg nor need_head_pool. Leave the TPA pointer resets to target commit 5ce7f36c334d. No functions are added.
Stable-dep-of: 5ce7f36c334d ("bnxt_en: Don't free the live ring's TPA state on queue restart failure")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -0
@@ -15441,6 +15441,8 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx)bnxt_free_one_tpa_info (bp, clone); err_free_rx_agg_ring:bnxt_free_ring (bp, &clone->rx_agg_ring_struct.ring_mem); +kfree (clone->rx_agg_bmap); + clone->rx_agg_bmap =NULL ; err_free_rx_ring:bnxt_free_ring (bp, &clone->rx_ring_struct.ring_mem); err_rxq_info_unreg:
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 4/4 bnxt_en: Don't free the live ring's TPA state on queue restart failure
In reply to Sasha LevinFrom: Joe Damato <[email protected]>
[ Upstream commit 5ce7f36c334d723954855ac769ede2fe0e8f89c8 ]
bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:
memcpy(clone, rxr, sizeof(*rxr));
the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned.
If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use.
Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -0
@@ -15389,6 +15389,8 @@ static int bnxt_queue_mem_alloc(struct net_device *dev, void *qmem, int idx) clone->rx_sw_agg_prod =0 ; clone->rx_next_cons =0 ; clone->rx_agg_bmap =NULL ; + clone->rx_tpa =NULL ; + clone->rx_tpa_idx_map =NULL ; rc =bnxt_alloc_rx_page_pool (bp, clone, rxr->page_pool->p.nid);if (rc)
Signature · 1 line
2.53.0