net: ethernet: cortina: Make RX SKB per-port

The SKB used to assemble packets from fragments in gmac_rx()
is static local, but the Gemini has two ethernet ports, meaning
there can be races between the ports on a bad day if a device
is using both.

Make the RX SKB a per-port variable and carry it over between
invocations in the port struct instead.

Zero the pointer once we call napi_gro_frags(), on error (after
calling napi_free_frags()) or if the port is stopped.

Zero it in some place where not strictly necessary just to
emphasize what is going on.

This was found by Sashiko during normal patch review.

Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
Link: https://sashiko.dev/#/patchset/20260505-gemini-ethernet-fix-v2-1-997c31d06079%40kernel.org
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260509-gemini-ethernet-fixes-v1-2-6c5d20ddc35b@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 466445c9e08b4746535e4e62dbe781c7ed93f73e..d5a56366fb432e5850b4c894c4dc43daec3532dc 100644 (file)
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -122,6 +122,8 @@ struct gemini_ethernet_port {
        struct napi_struct      napi;
        struct hrtimer          rx_coalesce_timer;
        unsigned int            rx_coalesce_nsecs;
+       struct sk_buff          *rx_skb;
+
        unsigned int            freeq_refill;
        struct gmac_txq         txq[TX_QUEUE_NUM];
        unsigned int            txq_order;
@@ -1442,10 +1444,10 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
        unsigned short m = (1 << port->rxq_order) - 1;
        struct gemini_ethernet *geth = port->geth;
        void __iomem *ptr_reg = port->rxq_rwptr;
+       struct sk_buff *skb = port->rx_skb;
        unsigned int frame_len, frag_len;
        struct gmac_rxdesc *rx = NULL;
        struct gmac_queue_page *gpage;
-       static struct sk_buff *skb;
        union gmac_rxdesc_0 word0;
        union gmac_rxdesc_1 word1;
        union gmac_rxdesc_3 word3;
@@ -1504,6 +1506,7 @@ static unsigned int gmac_rx(struct net_device *netdev, unsigned int budget)
                        if (skb) {
                                napi_free_frags(&port->napi);
                                port->stats.rx_dropped++;
+                               skb = NULL;
                        }
 
                        skb = gmac_skb_if_good_frame(port, word0, frame_len);
@@ -1554,6 +1557,7 @@ err_drop:
                port->stats.rx_dropped++;
        }
 
+       port->rx_skb = skb;
        writew(r, ptr_reg);
        return budget;
 }
@@ -1881,6 +1885,7 @@ static int gmac_stop(struct net_device *netdev)
        gmac_disable_tx_rx(netdev);
        gmac_stop_dma(port);
        napi_disable(&port->napi);
+       port->rx_skb = NULL;
 
        gmac_enable_irq(netdev, 0);
        gmac_cleanup_rxq(netdev);