5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Heiner Kallweit <hkallweit1@xxxxxxxxx> [ Upstream commit bd4bdeb4f29027199c68104fbdfa07ad45390cc1 ] In rtl_tx() the released descriptors are zero'ed by rtl8169_unmap_tx_skb(). And in the beginning of rtl8169_start_xmit() we check that enough descriptors are free, therefore there's no way the DescOwn bit can be set here. Signed-off-by: Heiner Kallweit <hkallweit1@xxxxxxxxx> Link: https://lore.kernel.org/r/6965d665-6c50-90c5-70e6-0bb335d4ea47@xxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.") Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> --- drivers/net/ethernet/realtek/r8169_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index dbf885f4dd01d..dd4404efdb8d6 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -4285,17 +4285,12 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, bool stop_queue, door_bell; u32 opts[2]; - txd_first = tp->TxDescArray + entry; - if (unlikely(!rtl_tx_slots_avail(tp))) { if (net_ratelimit()) netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); goto err_stop_0; } - if (unlikely(le32_to_cpu(txd_first->opts1) & DescOwn)) - goto err_stop_0; - opts[1] = rtl8169_tx_vlan_tag(skb); opts[0] = 0; @@ -4308,6 +4303,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, entry, false))) goto err_dma_0; + txd_first = tp->TxDescArray + entry; + if (frags) { if (rtl8169_xmit_frags(tp, skb, opts, entry)) goto err_dma_1; -- 2.43.0
