In DMAengine flow, AXI DMA driver invokes callback before freeing BD in irq handling path. In Rx callback (axienet_dma_rx_cb()), axienet driver tries to allocate new BD after processing skb. This will be problematic if both AXI-DMA and AXI ethernet have same BD count as all Rx BDs will be allocated initially and it won't be able to allocate new one after Rx irq. Incrementing head pointer w/o checking for BD allocation will result in garbage values in skb BD and cause the below kernel crash: Unable to handle kernel paging request at virtual address fffffffffffffffa Internal error: Oops: 0000000096000006 [#1] SMP pc : axienet_dma_rx_cb+0x78/0x150 lr : axienet_dma_rx_cb+0x78/0x150 Call trace: axienet_dma_rx_cb+0x78/0x150 (P) xilinx_dma_do_tasklet+0xdc/0x290 tasklet_action_common+0x12c/0x178 tasklet_action+0x30/0x3c handle_softirqs+0xf8/0x230 Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") Signed-off-by: Suraj Gupta --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c index 6011d7eae0c7..acd5be60afec 100644 --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -1457,7 +1457,6 @@ static void axienet_rx_submit_desc(struct net_device *ndev) if (!skbuf_dma) return; - lp->rx_ring_head++; skb = netdev_alloc_skb(ndev, lp->max_frm_size); if (!skb) return; @@ -1482,6 +1481,7 @@ static void axienet_rx_submit_desc(struct net_device *ndev) skbuf_dma->desc = dma_rx_desc; dma_rx_desc->callback_param = lp; dma_rx_desc->callback_result = axienet_dma_rx_cb; + lp->rx_ring_head++; dmaengine_submit(dma_rx_desc); return; -- 2.25.1