Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2223358/?format=api
{ "id": 2223358, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2223358/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20260415060833.2303846-3-wei.fang@nxp.com/", "project": { "id": 2, "url": "http://patchwork.ozlabs.org/api/1.2/projects/2/?format=api", "name": "Linux PPC development", "link_name": "linuxppc-dev", "list_id": "linuxppc-dev.lists.ozlabs.org", "list_email": "linuxppc-dev@lists.ozlabs.org", "web_url": "https://github.com/linuxppc/wiki/wiki", "scm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git", "webscm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/", "list_archive_url": "https://lore.kernel.org/linuxppc-dev/", "list_archive_url_format": "https://lore.kernel.org/linuxppc-dev/{}/", "commit_url_format": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?id={}" }, "msgid": "<20260415060833.2303846-3-wei.fang@nxp.com>", "list_archive_url": "https://lore.kernel.org/linuxppc-dev/20260415060833.2303846-3-wei.fang@nxp.com/", "date": "2026-04-15T06:08:33", "name": "[v2,net,2/2] net: enetc: fix NTMP DMA use-after-free issue", "commit_ref": null, "pull_url": null, "state": "handled-elsewhere", "archived": false, "hash": "a388af4dca6afdafbac5f7393c7a66b5053af586", "submitter": { "id": 84380, "url": "http://patchwork.ozlabs.org/api/1.2/people/84380/?format=api", "name": "Wei Fang", "email": "wei.fang@nxp.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20260415060833.2303846-3-wei.fang@nxp.com/mbox/", "series": [ { "id": 499927, "url": "http://patchwork.ozlabs.org/api/1.2/series/499927/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=499927", "date": "2026-04-15T06:08:31", "name": "net: enetc: fix command BD ring issues", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/499927/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2223358/comments/", "check": "success", "checks": "http://patchwork.ozlabs.org/api/patches/2223358/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linuxppc-dev+bounces-19751-incoming=patchwork.ozlabs.org@lists.ozlabs.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linuxppc-dev@lists.ozlabs.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=nxp.com header.i=@nxp.com header.a=rsa-sha256\n header.s=selector1 header.b=iCHbjb2O;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org\n (client-ip=2404:9400:21b9:f100::1; helo=lists.ozlabs.org;\n envelope-from=linuxppc-dev+bounces-19751-incoming=patchwork.ozlabs.org@lists.ozlabs.org;\n receiver=patchwork.ozlabs.org)", "lists.ozlabs.org;\n arc=pass smtp.remote-ip=\"2a01:111:f403:c200::1\" arc.chain=microsoft.com", "lists.ozlabs.org;\n dmarc=pass (p=none dis=none) header.from=nxp.com", "lists.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=nxp.com header.i=@nxp.com header.a=rsa-sha256\n header.s=selector1 header.b=iCHbjb2O;\n\tdkim-atps=neutral", "lists.ozlabs.org;\n spf=permerror (SPF Permanent Error: Void lookup limit of 2 exceeded)\n smtp.mailfrom=nxp.com (client-ip=2a01:111:f403:c200::1;\n helo=db3pr0202cu003.outbound.protection.outlook.com;\n envelope-from=wei.fang@nxp.com; receiver=lists.ozlabs.org)", "dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=nxp.com;" ], "Received": [ "from lists.ozlabs.org (lists.ozlabs.org\n [IPv6:2404:9400:21b9:f100::1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwVzB48gnz1yCv\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 15 Apr 2026 16:07:02 +1000 (AEST)", "from boromir.ozlabs.org (localhost [127.0.0.1])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 4fwVyy1MX5z307K;\n\tWed, 15 Apr 2026 16:06:50 +1000 (AEST)", "from DB3PR0202CU003.outbound.protection.outlook.com\n (mail-northeuropeazlp170100001.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c200::1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange secp256r1 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 4fwVyw5x5yz3069\n\tfor <linuxppc-dev@lists.ozlabs.org>; Wed, 15 Apr 2026 16:06:48 +1000 (AEST)", "from AM8PR04MB7284.eurprd04.prod.outlook.com (2603:10a6:20b:1dc::8)\n by PA4PR04MB8062.eurprd04.prod.outlook.com (2603:10a6:102:b8::10) with\n Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.48; Wed, 15 Apr\n 2026 06:06:24 +0000", "from AM8PR04MB7284.eurprd04.prod.outlook.com\n ([fe80::9cd6:51bd:82b:98dc]) by AM8PR04MB7284.eurprd04.prod.outlook.com\n ([fe80::9cd6:51bd:82b:98dc%5]) with mapi id 15.20.9769.046; Wed, 15 Apr 2026\n 06:06:24 +0000" ], "ARC-Seal": [ "i=2; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1776233210;\n\tcv=pass;\n b=GO+egrrLbT9DehVt6Lh4G4/MKnYNO7my3I3udEKMMCJaCFqHuO8YjdAXqbzEP+8qf/2oVlBjEwMAt4SynRgmPtGfjdVXRTieUvrJittP4pl25iNOneXCtWb0T21BQolcHo7cp0wNJBvJq9uoTmdMr9gEQd7P4UOOL7IlhPC6UWQTbwTJ1G5m7Wd8CiR4E8Yho0zVF93y3u4l39mJloodFzlqw2QoXu9EGSEh8ibaWDaEHTS1a/GdoGHYnBbzv7FlOaSM2aTwa4RyS2TUlshdsE39cmQf+KyXRcCpAW0NHo0wZTBykE5aVKD7mS4nfUT/af8gV0EqZx4FwmRszM9Yyg==", "i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=JYpua6QuO1HnmsclkN3Hy2gduVmNUCBg2cyaJet4uQcxhqZZ+vm3fkPqWEvTGhGowdEID0u0aOUS93hnD+7GxDxf3PllDIpOQydArKU/lvTXPIEu1pjsA9e+9CEoHvhYOG7LwBCNqaD6fSMs3c0zYXiBhrmGeGKnUMiP++4M8qZKG44ituvRhJFQfGgY7Q1ZMZKn+HUs1cFWiPUNK8TObPZZHpx9F7T7kHkt3TLakz2RYp+54+zkLjHmScmXCOnoslUx/zx8s2uhJ3TWkoFy6FwMmFOYTZSAk3gzckFuoNyUSE2kUX0+GULL1CSerND9Q/2A/+LljQLqHTabEIwV/g==" ], "ARC-Message-Signature": [ "i=2; a=rsa-sha256; d=lists.ozlabs.org; s=201707;\n\tt=1776233210; c=relaxed/relaxed;\n\tbh=XN1eWleX3WsJNDBk2xaHqHNzbZjf6E1gbEqnSncSPFY=;\n\th=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:\n\t Content-Type:MIME-Version;\n b=Vx7R+Ako2Pb6uFUET+uYlOCd9sCxZUCknIcImAU4PujvW/nYjMp80jx0NfqByLg75HaPR38uHMzlExa+dk9aLdjA8kBSqNQhZxa9UzS1W49ueevT1cVnIPzPbRRJhF2HXzg2w07ptBvAVVr4DWAKNePDo26Ka8B4/+QmLZUFqbY4iNn94LDSlHTrz0LB5g1J7YsYl9lW7wRZARNb4oIjyduJiVX8kcX7RTjRPJSlp7FuG6PrKkw9ntem7RNz6L/UsqqhciCPKr9dHyvBK++bMmAbiuriZqDQTE46SuT92BWu5gj7cHgOFhIHObwSpCkA1eqZg/xkARmLwNbWAzL7xw==", "i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=XN1eWleX3WsJNDBk2xaHqHNzbZjf6E1gbEqnSncSPFY=;\n b=utbWQiauI0GxbsfI+N1Pql9Ggc7Sw/Qiojnp5O6jHv6CBvYZW93EAKv/PtbuhB1s77C0f+VA/u7lWnHeLU+7bcX+7gpQ2BJaKrYxhCBlYM6ZmQSArKBW33dKK5RVvFA7vlUPiiRo1EkzTm4P94ZEKTZ3HlY9dIcOBnNbW19OhmbnTky/gqIWIPAR+3wCSE0IUZOu4vPImKyqHMspp7JG1QjkIxlUUXtgEOfbHlPpo86XsQohawh7y+cmDMbPVx5CsHx4EekCg7S1T1yQ+CB9sCBufWDsSwro0NVqJm0KQSts2XU7wt3yAl/Yp1aEfYGNfLd9ILQXNHrE161UUDAQUg==" ], "ARC-Authentication-Results": [ "i=2; lists.ozlabs.org;\n dmarc=pass (p=none dis=none) header.from=nxp.com; dkim=pass (2048-bit key;\n unprotected) header.d=nxp.com header.i=@nxp.com header.a=rsa-sha256\n header.s=selector1 header.b=iCHbjb2O; dkim-atps=neutral;\n spf=permerror (client-ip=2a01:111:f403:c200::1;\n helo=db3pr0202cu003.outbound.protection.outlook.com;\n envelope-from=wei.fang@nxp.com;\n receiver=lists.ozlabs.org) smtp.mailfrom=nxp.com", "i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=nxp.com; dmarc=pass action=none header.from=nxp.com; dkim=pass\n header.d=nxp.com; arc=none" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=nxp.com; s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=XN1eWleX3WsJNDBk2xaHqHNzbZjf6E1gbEqnSncSPFY=;\n b=iCHbjb2OwTfvVS/8EroqL5/fu7WwrcgqXG3V2H3Xuu8hcciMESLlAAQSsxPsQSEIp1mIrIrrsgXZKGixRNuuhCQDYkOjD8k3gZ4/zQnn0k7HKOQo9R1dCE8c5ku7mL4ugAMKav8b+zcEsDwJPK96XTabBEtcDY3Nb8ciDRiKoNfdPisUd4UOL+HTcNeOQ4K/o2lWGxvUZoGSS9c+QiVZVTYrTa2FbfmUcgKwNj3CJ9ompkvd6lOQDuDDVijs+Y1knamImxTHI/8GiuNqE05EOjtxzvjxKOQR9hrJOyjNQF1nU6BRoggF3JWaJIEy4OaTLtVzFz1lNOeECGdIUC3ZIg==", "From": "Wei Fang <wei.fang@nxp.com>", "To": "claudiu.manoil@nxp.com,\n\tvladimir.oltean@nxp.com,\n\txiaoning.wang@nxp.com,\n\tandrew+netdev@lunn.ch,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tchleroy@kernel.org", "Cc": "netdev@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\timx@lists.linux.dev,\n\tlinuxppc-dev@lists.ozlabs.org,\n\tlinux-arm-kernel@lists.infradead.org", "Subject": "[PATCH v2 net 2/2] net: enetc: fix NTMP DMA use-after-free issue", "Date": "Wed, 15 Apr 2026 14:08:33 +0800", "Message-Id": "<20260415060833.2303846-3-wei.fang@nxp.com>", "X-Mailer": "git-send-email 2.34.1", "In-Reply-To": "<20260415060833.2303846-1-wei.fang@nxp.com>", "References": "<20260415060833.2303846-1-wei.fang@nxp.com>", "Content-Transfer-Encoding": "8bit", "Content-Type": "text/plain", "X-ClientProxiedBy": "SG2PR06CA0243.apcprd06.prod.outlook.com\n (2603:1096:4:ac::27) To AM8PR04MB7284.eurprd04.prod.outlook.com\n (2603:10a6:20b:1dc::8)", "X-Mailing-List": "linuxppc-dev@lists.ozlabs.org", "List-Id": "<linuxppc-dev.lists.ozlabs.org>", "List-Help": "<mailto:linuxppc-dev+help@lists.ozlabs.org>", "List-Owner": "<mailto:linuxppc-dev+owner@lists.ozlabs.org>", "List-Post": "<mailto:linuxppc-dev@lists.ozlabs.org>", "List-Archive": "<https://lore.kernel.org/linuxppc-dev/>,\n <https://lists.ozlabs.org/pipermail/linuxppc-dev/>", "List-Subscribe": "<mailto:linuxppc-dev+subscribe@lists.ozlabs.org>,\n <mailto:linuxppc-dev+subscribe-digest@lists.ozlabs.org>,\n <mailto:linuxppc-dev+subscribe-nomail@lists.ozlabs.org>", "List-Unsubscribe": "<mailto:linuxppc-dev+unsubscribe@lists.ozlabs.org>", "Precedence": "list", "MIME-Version": "1.0", "X-MS-PublicTrafficType": "Email", "X-MS-TrafficTypeDiagnostic": "AM8PR04MB7284:EE_|PA4PR04MB8062:EE_", "X-MS-Office365-Filtering-Correlation-Id": "3c3425bb-556f-4954-721a-08de9ab51f5d", "X-MS-Exchange-SenderADCheck": "1", "X-MS-Exchange-AntiSpam-Relay": "0", "X-Microsoft-Antispam": "\n\tBCL:0;ARA:13230040|7416014|376014|52116014|19092799006|1800799024|366016|38350700014|22082099003|18002099003|56012099003;", "X-Microsoft-Antispam-Message-Info": "\n\tVqeNxuyctLGeL47f8nNXDaEknt9fVZlmIfhfibdUETh2uhU/CC4JIe0epsHz2DLxBlaRTsaIos2PTFKmtnSUX3KT+YByXw3isKyRtTiG+JR2iAk2NsvsMEa4vWZtqGgi8JvA5vvyvFGE9vQSbfKg6x4bA+sEzkRR88ZAncrCqBpd8/1uBNPfjokUAZnNR1gw/yK+byCoJAEPrMfaN4E/g7hAnvYFaqCOufntXz4Rwd/fet7HrtOH94NBl0vWb8RR76cMhyE59o7m9SZgS4gB5MGSHPC2SAyYZQw2tnlYdwJVFUyExm9CfPcOubT/vkar3kJ27aeFt/yG+6vhMja+USH9Hk/VASQwnZq76039Jkh2BGIq0ontfXcnuC7T8052wUKDNMMfwUpIXhnxAKM4J5HCRJMDfUQlR62/9fmjvajVvg+C/B1vLem86pBA4hjc1p0FaQVNvajnMH+gG0ZHCQqjkvu9uxf/fVBiiKO/lM4HVsXKrKtLhyTvaqgavuIMIgXPobXE5l2c/KsRxFgnmMp+J2A15l4ObT/TqrWGYmP1YmjYDTLALhLUGdh2oloWWMCDmC8jqghSQmJg9XGAtmDkxOLqvxj4SetZiXXti4LAykesu0/cTHSOwEXH8RGfFOHkxDVoa2aXz/uNaJattMqZ9SHUqPgAvXbHKkBuR1jK20SolTY6zB+KUiudpQbNrWYpgc+xjMKR+OuIjsEyrx7VaJGlJs06qJriId7wlC5rOWjLg6euDP7ogB5QchYLPRdej9+4a1EyND0MCdVkYG0Neal21e4b5NT+0n6myJc=", "X-Forefront-Antispam-Report": "\n\tCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM8PR04MB7284.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(7416014)(376014)(52116014)(19092799006)(1800799024)(366016)(38350700014)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1101;", "X-MS-Exchange-AntiSpam-MessageData-ChunkCount": "1", "X-MS-Exchange-AntiSpam-MessageData-0": "\n lYA7izt4rRUR6YN8f0l/+5Qi5coDxAuu2kKKKqU7ensqB4pHJiLrlyinE8O7xQeHY7pl+gm/x9g9raOA0NDQZe4re6BWIx4AlOnAGQZZG5R6Nq/pSeI9JPHiLdFoE5ZmvfugiwlpsdlxN+/MgOqN3MYRWpdThE+ViAsv4d03lWfHdwgJ6ShySyuuoWFXhAByxIgv0gdY1gJoluq8eFQa/TfuY37tSbnpW7QWdBfB9hVCFm2Rvi8QQcDonsGI5RKVBHyp/Jr6dTFeXzR3ZZNCgihFME5/i6p1eofq5JOh5e4RgDomWsmI9pdEeP8YuzeUXKrKPwPFwJ8jB4oThJtnhD8SuqwkKKYtLjxXCngZjbD3dwjZBxjTMSQyt+TgDmHKLTHL+zDqWgv2p+xH+yJKEvQG3I3JIVOMiKx3nHPxXWMYzEDSjRyKyX7Ty38G6WyEBcIIex7VkUWRQgGp56d+xBVwLTE7opBU6vr2CUjKHrps3VNGtJ047LUBKoCktraEEVFWdS6abv99aVaDnPzCbgzcLpO1bS6ORKxsPcZwHCWJVml5Kc2HPkcc8RoKZxh8dHWZTKLLIp1+7b3Bnik9+rHP7OYTevZBFv2r9xsCLM6ZeKzL8oR4yA3fVWEHci8qx64S1D2bKuds3wCRz9y4dKojG+SbRuXjjp7h1dkL0MI/UR2TeneqGHd45Fn8MEkLgkCPzPbu/2NpYMRxA0gWqSV2Li2KxBiMPP0i2H4QeAau/5+gEROwqGDHO/GsbsZpf0qazAzSnjnN5WLRob+FZ8cyqTyzwwhzi8+ySE/21ddH+BZoR264yTD8CplqKfC0QvzuYA+2kvbhLQic6+0ZmIbXEQxQEFpdH3AroX84yGNYgYm1SR2D6bAXUImRy9jHv65gILgYKVT1ovg6f0Um9ykAlCXx9+sUYikgw6DDa1XbBiKdEpBFlWYfeWLZI32Zj5vwVmrmJbza+qzcTxdbgIyGcui2OCFmWGXKjhqop65RUaWzuyBPjd+8zWgRnmsEBrp9iMh0PvKLzNEEmVLiogCV1nZpLcBOSaAqiaseIW8fsx7ZWRQp1tcCkPpXGCdvhBPeWPdmEy9kV4h7HE7CDNzBAAPA5yrgv3SrAMG42IfohJxtO6kAYLIvVqyb0pgBwUstj027NjzoOuuep7bjF4llZeSmAAA2OwtGaOKX/YDWN0uiBWo4Kvu2tMKGKfigzv3+qfSOIET18tUfM1N6vWzJ/Yr/MmPwj4eXcgs2AVipkFvHzzAJebClqZ4mTqKzVoQFrfVWsV04Y1nfoOf2hI/wkYpQOSzlumUiVlC07xyWMCst59tN4JgaqItGNDJ6band6iP2FUnE7YDsAdXQArADbRTny9yxfQ/OAIc8e1aBdEAK0n/9VdqdSrC46hdCHSrxfcVRY6Bl8rirHNYqYLcG5w1vhOX82x67GWSbSn87au6XpsQjvF92HOMRLV8qlFvgVXofDQt5KY7q9ClqAeGxNXnwRdYoP3VkPpqr/mNiMMhXhCgeVONiEStv62rfGaf7RapapTsujxyeakQ+vKQF+QJAZv20Z2budGXnI1IBcWEf7+5DBro0RtfOj6Sf34a64CH/0bMpH3uGNAp72/Ab7F0gessu9pmFTKv0pV1/8ynkOTzxf0qQvFhD2n/pyXnKHkaHjR8KUmyQDfTD0dq2NDM+OdaS2egvty3IPcU1Ofy2i98n9iZcKQr+yEKLwbkEC7Uu9imZwaq21urXMQ==", "X-OriginatorOrg": "nxp.com", "X-MS-Exchange-CrossTenant-Network-Message-Id": "\n 3c3425bb-556f-4954-721a-08de9ab51f5d", "X-MS-Exchange-CrossTenant-AuthSource": "AM8PR04MB7284.eurprd04.prod.outlook.com", "X-MS-Exchange-CrossTenant-AuthAs": "Internal", "X-MS-Exchange-CrossTenant-OriginalArrivalTime": "15 Apr 2026 06:06:24.2254\n (UTC)", "X-MS-Exchange-CrossTenant-FromEntityHeader": "Hosted", "X-MS-Exchange-CrossTenant-Id": "686ea1d3-bc2b-4c6f-a92c-d99c5c301635", "X-MS-Exchange-CrossTenant-MailboxType": "HOSTED", "X-MS-Exchange-CrossTenant-UserPrincipalName": "\n I0mDHgAy3st5+Pk88fkcJk8F86HQ1CRFiiu89j9DQfl5XW21K3ZvO/M7gRDIho2GWmtHjpPq2IruAIpFCS7ZFw==", "X-MS-Exchange-Transport-CrossTenantHeadersStamped": "PA4PR04MB8062", "X-Spam-Status": "No, score=0.8 required=3.0 tests=ARC_SIGNED,ARC_VALID,\n\tDKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,\n\tSPF_HELO_PASS,T_SPF_PERMERROR autolearn=disabled version=4.0.1 OzLabs 8", "X-Spam-Checker-Version": "SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org" }, "content": "The AI-generated review reported a potential DMA use-after-free issue\n[1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending\ncommand is not explicitly aborted, while ntmp_free_data_mem()\nunconditionally frees the DMA buffer. If the buffer has already been\nreallocated elsewhere, this may lead to silent memory corruption. Because\nthe hardware eventually processes the pending command and perform a DMA\nwrite of the response to the physical address of the freed buffer.\n\nTo resolve this issue, this patch does the following modifications:\n\n1. Convert cbdr->ring_lock from a spinlock to a mutex\n\nThe lock was originally a spinlock in case NTMP operations might be\ninvoked from atomic context. After downstream support for all NTMP\ntables, no such usage has materialized. A mutex lock is now required\nbecause the driver now needs to reclaim used BDs and release associated\nDMA memory within the lock's context, while dma_free_coherent() might\nsleep.\n\n2. Introduce software command BD (struct netc_swcbd)\n\nThe hardware write-back overwrites the addr and len fields of the BD,\nso the driver cannot rely on the hardware BD to free the associated DMA\nmemory. The driver now maintains a software shadow BD storing the DMA\nbuffer pointer, DMA address, and size. And netc_xmit_ntmp_cmd() only\nreclaims older BDs when the number of used BDs reaches\nNETC_CBDR_CLEAN_WORK (16). The software BD enables correct DMA memory\nrelease. With this, struct ntmp_dma_buf and ntmp_free_data_mem() are no\nlonger needed and are removed.\n\n3. Require callers to hold ring_lock across netc_xmit_ntmp_cmd()\n\nnetc_xmit_ntmp_cmd() releases the ring_lock before the caller finishes\nconsuming the response. At this point, if a concurrent thread submits\na new command, it may trigger ntmp_clean_cbdr() and free the DMA buffer\nwhile it is still in use. Move ring_lock ownership to the caller to\nensure the response buffer cannot be reclaimed prematurely. So the\nhelpers ntmp_select_and_lock_cbdr() and ntmp_unlock_cbdr() are added.\n\nThese changes eliminate the DMA use-after-free condition and ensure safe\nand consistent BD reclamation and DMA buffer lifecycle management.\n\nFixes: 4701073c3deb (\"net: enetc: add initial netc-lib driver to support NTMP\")\nLink: https://lore.kernel.org/netdev/20260403011729.1795413-1-kuba@kernel.org/ # [1]\nSigned-off-by: Wei Fang <wei.fang@nxp.com>\n---\n drivers/net/ethernet/freescale/enetc/ntmp.c | 214 ++++++++++--------\n .../ethernet/freescale/enetc/ntmp_private.h | 8 +-\n include/linux/fsl/ntmp.h | 9 +-\n 3 files changed, 134 insertions(+), 97 deletions(-)", "diff": "diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c\nindex b188eb2d40c0..70bbc5d2d5d4 100644\n--- a/drivers/net/ethernet/freescale/enetc/ntmp.c\n+++ b/drivers/net/ethernet/freescale/enetc/ntmp.c\n@@ -7,6 +7,7 @@\n #include <linux/dma-mapping.h>\n #include <linux/fsl/netc_global.h>\n #include <linux/iopoll.h>\n+#include <linux/vmalloc.h>\n \n #include \"ntmp_private.h\"\n \n@@ -42,6 +43,12 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,\n \tif (!cbdr->addr_base)\n \t\treturn -ENOMEM;\n \n+\tcbdr->swcbd = vcalloc(cbd_num, sizeof(struct netc_swcbd));\n+\tif (!cbdr->swcbd) {\n+\t\tdma_free_coherent(dev, size, cbdr->addr_base, cbdr->dma_base);\n+\t\treturn -ENOMEM;\n+\t}\n+\n \tcbdr->dma_size = size;\n \tcbdr->bd_num = cbd_num;\n \tcbdr->regs = *regs;\n@@ -52,7 +59,7 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,\n \tcbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base,\n \t\t\t\t\t NTMP_BASE_ADDR_ALIGN);\n \n-\tspin_lock_init(&cbdr->ring_lock);\n+\tmutex_init(&cbdr->ring_lock);\n \n \tcbdr->next_to_use = netc_read(cbdr->regs.pir);\n \tcbdr->next_to_clean = netc_read(cbdr->regs.cir) & NETC_CBDRCIR_INDEX;\n@@ -71,10 +78,24 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,\n }\n EXPORT_SYMBOL_GPL(ntmp_init_cbdr);\n \n+static void ntmp_free_data_mem(struct device *dev, struct netc_swcbd *swcbd)\n+{\n+\tif (unlikely(!swcbd->buf))\n+\t\treturn;\n+\n+\tdma_free_coherent(dev, swcbd->size + NTMP_DATA_ADDR_ALIGN,\n+\t\t\t swcbd->buf, swcbd->dma);\n+}\n+\n void ntmp_free_cbdr(struct netc_cbdr *cbdr)\n {\n \t/* Disable the Control BD Ring */\n \tnetc_write(cbdr->regs.mr, 0);\n+\n+\tfor (int i = 0; i < cbdr->bd_num; i++)\n+\t\tntmp_free_data_mem(cbdr->dev, &cbdr->swcbd[i]);\n+\n+\tvfree(cbdr->swcbd);\n \tdma_free_coherent(cbdr->dev, cbdr->dma_size, cbdr->addr_base,\n \t\t\t cbdr->dma_base);\n \tmemset(cbdr, 0, sizeof(*cbdr));\n@@ -94,40 +115,59 @@ static union netc_cbd *ntmp_get_cbd(struct netc_cbdr *cbdr, int index)\n \n static void ntmp_clean_cbdr(struct netc_cbdr *cbdr)\n {\n-\tunion netc_cbd *cbd;\n-\tint i;\n+\tint i = cbdr->next_to_clean;\n \n-\ti = cbdr->next_to_clean;\n \twhile ((netc_read(cbdr->regs.cir) & NETC_CBDRCIR_INDEX) != i) {\n-\t\tcbd = ntmp_get_cbd(cbdr, i);\n+\t\tunion netc_cbd *cbd = ntmp_get_cbd(cbdr, i);\n+\t\tstruct netc_swcbd *swcbd = &cbdr->swcbd[i];\n+\n+\t\tntmp_free_data_mem(cbdr->dev, swcbd);\n+\t\tmemset(swcbd, 0, sizeof(*swcbd));\n \t\tmemset(cbd, 0, sizeof(*cbd));\n \t\ti = (i + 1) % cbdr->bd_num;\n \t}\n \n+\tdma_wmb();\n \tcbdr->next_to_clean = i;\n }\n \n-static int netc_xmit_ntmp_cmd(struct ntmp_user *user, union netc_cbd *cbd)\n+static void ntmp_select_and_lock_cbdr(struct ntmp_user *user,\n+\t\t\t\t struct netc_cbdr **cbdr)\n+{\n+\t/* Currently only ENETC is supported, and it has only one command\n+\t * BD ring.\n+\t */\n+\t*cbdr = &user->ring[0];\n+\n+\tmutex_lock(&(*cbdr)->ring_lock);\n+}\n+\n+static void ntmp_unlock_cbdr(struct netc_cbdr *cbdr)\n+{\n+\tmutex_unlock(&cbdr->ring_lock);\n+}\n+\n+static int netc_xmit_ntmp_cmd(struct netc_cbdr *cbdr, union netc_cbd *cbd,\n+\t\t\t struct netc_swcbd *swcbd)\n {\n \tunion netc_cbd *cur_cbd;\n-\tstruct netc_cbdr *cbdr;\n-\tint i, err;\n+\tint i, err, used_bds;\n \tu16 status;\n \tu32 val;\n \n-\t/* Currently only i.MX95 ENETC is supported, and it only has one\n-\t * command BD ring\n-\t */\n-\tcbdr = &user->ring[0];\n-\n-\tspin_lock_bh(&cbdr->ring_lock);\n-\n-\tif (unlikely(!ntmp_get_free_cbd_num(cbdr)))\n+\tused_bds = cbdr->bd_num - ntmp_get_free_cbd_num(cbdr);\n+\tif (unlikely(used_bds >= NETC_CBDR_CLEAN_WORK)) {\n \t\tntmp_clean_cbdr(cbdr);\n+\t\tif (unlikely(!ntmp_get_free_cbd_num(cbdr))) {\n+\t\t\tntmp_free_data_mem(cbdr->dev, swcbd);\n+\t\t\treturn -EBUSY;\n+\t\t}\n+\t}\n \n \ti = cbdr->next_to_use;\n \tcur_cbd = ntmp_get_cbd(cbdr, i);\n \t*cur_cbd = *cbd;\n+\tcbdr->swcbd[i] = *swcbd;\n \tdma_wmb();\n \n \t/* Update producer index of both software and hardware */\n@@ -135,17 +175,16 @@ static int netc_xmit_ntmp_cmd(struct ntmp_user *user, union netc_cbd *cbd)\n \tcbdr->next_to_use = i;\n \tnetc_write(cbdr->regs.pir, i);\n \n-\terr = read_poll_timeout_atomic(netc_read, val,\n-\t\t\t\t (val & NETC_CBDRCIR_INDEX) == i,\n-\t\t\t\t NETC_CBDR_DELAY_US, NETC_CBDR_TIMEOUT,\n-\t\t\t\t true, cbdr->regs.cir);\n+\terr = read_poll_timeout(netc_read, val,\n+\t\t\t\t(val & NETC_CBDRCIR_INDEX) == i,\n+\t\t\t\tNETC_CBDR_DELAY_US, NETC_CBDR_TIMEOUT,\n+\t\t\t\ttrue, cbdr->regs.cir);\n \tif (unlikely(err))\n-\t\tgoto cbdr_unlock;\n+\t\treturn err;\n \n \tif (unlikely(val & NETC_CBDRCIR_SBE)) {\n-\t\tdev_err(user->dev, \"Command BD system bus error\\n\");\n-\t\terr = -EIO;\n-\t\tgoto cbdr_unlock;\n+\t\tdev_err(cbdr->dev, \"Command BD system bus error\\n\");\n+\t\treturn -EIO;\n \t}\n \n \tdma_rmb();\n@@ -157,40 +196,29 @@ static int netc_xmit_ntmp_cmd(struct ntmp_user *user, union netc_cbd *cbd)\n \t/* Check the writeback error status */\n \tstatus = le16_to_cpu(cbd->resp_hdr.error_rr) & NTMP_RESP_ERROR;\n \tif (unlikely(status)) {\n-\t\terr = -EIO;\n-\t\tdev_err(user->dev, \"Command BD error: 0x%04x\\n\", status);\n+\t\tdev_err(cbdr->dev, \"Command BD error: 0x%04x\\n\", status);\n+\t\treturn -EIO;\n \t}\n \n-\tntmp_clean_cbdr(cbdr);\n-\tdma_wmb();\n-\n-cbdr_unlock:\n-\tspin_unlock_bh(&cbdr->ring_lock);\n-\n-\treturn err;\n+\treturn 0;\n }\n \n-static int ntmp_alloc_data_mem(struct ntmp_dma_buf *data, void **buf_align)\n+static int ntmp_alloc_data_mem(struct device *dev, struct netc_swcbd *swcbd,\n+\t\t\t void **buf_align)\n {\n \tvoid *buf;\n \n-\tbuf = dma_alloc_coherent(data->dev, data->size + NTMP_DATA_ADDR_ALIGN,\n-\t\t\t\t &data->dma, GFP_KERNEL);\n+\tbuf = dma_alloc_coherent(dev, swcbd->size + NTMP_DATA_ADDR_ALIGN,\n+\t\t\t\t &swcbd->dma, GFP_KERNEL);\n \tif (!buf)\n \t\treturn -ENOMEM;\n \n-\tdata->buf = buf;\n+\tswcbd->buf = buf;\n \t*buf_align = PTR_ALIGN(buf, NTMP_DATA_ADDR_ALIGN);\n \n \treturn 0;\n }\n \n-static void ntmp_free_data_mem(struct ntmp_dma_buf *data)\n-{\n-\tdma_free_coherent(data->dev, data->size + NTMP_DATA_ADDR_ALIGN,\n-\t\t\t data->buf, data->dma);\n-}\n-\n static void ntmp_fill_request_hdr(union netc_cbd *cbd, dma_addr_t dma,\n \t\t\t\t int len, int table_id, int cmd,\n \t\t\t\t int access_method)\n@@ -241,37 +269,39 @@ static int ntmp_delete_entry_by_id(struct ntmp_user *user, int tbl_id,\n \t\t\t\t u8 tbl_ver, u32 entry_id, u32 req_len,\n \t\t\t\t u32 resp_len)\n {\n-\tstruct ntmp_dma_buf data = {\n-\t\t.dev = user->dev,\n+\tstruct netc_swcbd swcbd = {\n \t\t.size = max(req_len, resp_len),\n \t};\n \tstruct ntmp_req_by_eid *req;\n+\tstruct netc_cbdr *cbdr;\n \tunion netc_cbd cbd;\n \tint err;\n \n-\terr = ntmp_alloc_data_mem(&data, (void **)&req);\n+\terr = ntmp_alloc_data_mem(user->dev, &swcbd, (void **)&req);\n \tif (err)\n \t\treturn err;\n \n \tntmp_fill_crd_eid(req, tbl_ver, 0, 0, entry_id);\n-\tntmp_fill_request_hdr(&cbd, data.dma, NTMP_LEN(req_len, resp_len),\n+\tntmp_fill_request_hdr(&cbd, swcbd.dma, NTMP_LEN(req_len, resp_len),\n \t\t\t tbl_id, NTMP_CMD_DELETE, NTMP_AM_ENTRY_ID);\n \n-\terr = netc_xmit_ntmp_cmd(user, &cbd);\n+\tntmp_select_and_lock_cbdr(user, &cbdr);\n+\terr = netc_xmit_ntmp_cmd(cbdr, &cbd, &swcbd);\n \tif (err)\n \t\tdev_err(user->dev,\n \t\t\t\"Failed to delete entry 0x%x of %s, err: %pe\",\n \t\t\tentry_id, ntmp_table_name(tbl_id), ERR_PTR(err));\n-\n-\tntmp_free_data_mem(&data);\n+\tntmp_unlock_cbdr(cbdr);\n \n \treturn err;\n }\n \n-static int ntmp_query_entry_by_id(struct ntmp_user *user, int tbl_id,\n-\t\t\t\t u32 len, struct ntmp_req_by_eid *req,\n-\t\t\t\t dma_addr_t dma, bool compare_eid)\n+static int ntmp_query_entry_by_id(struct netc_cbdr *cbdr, int tbl_id,\n+\t\t\t\t struct ntmp_req_by_eid *req,\n+\t\t\t\t struct netc_swcbd *swcbd,\n+\t\t\t\t bool compare_eid)\n {\n+\tu32 len = NTMP_LEN(sizeof(*req), swcbd->size);\n \tstruct ntmp_cmn_resp_query *resp;\n \tint cmd = NTMP_CMD_QUERY;\n \tunion netc_cbd cbd;\n@@ -283,10 +313,11 @@ static int ntmp_query_entry_by_id(struct ntmp_user *user, int tbl_id,\n \t\tcmd = NTMP_CMD_QU;\n \n \t/* Request header */\n-\tntmp_fill_request_hdr(&cbd, dma, len, tbl_id, cmd, NTMP_AM_ENTRY_ID);\n-\terr = netc_xmit_ntmp_cmd(user, &cbd);\n+\tntmp_fill_request_hdr(&cbd, swcbd->dma, len, tbl_id, cmd,\n+\t\t\t NTMP_AM_ENTRY_ID);\n+\terr = netc_xmit_ntmp_cmd(cbdr, &cbd, swcbd);\n \tif (err) {\n-\t\tdev_err(user->dev,\n+\t\tdev_err(cbdr->dev,\n \t\t\t\"Failed to query entry 0x%x of %s, err: %pe\\n\",\n \t\t\tentry_id, ntmp_table_name(tbl_id), ERR_PTR(err));\n \t\treturn err;\n@@ -300,7 +331,7 @@ static int ntmp_query_entry_by_id(struct ntmp_user *user, int tbl_id,\n \n \tresp = (struct ntmp_cmn_resp_query *)req;\n \tif (unlikely(le32_to_cpu(resp->entry_id) != entry_id)) {\n-\t\tdev_err(user->dev,\n+\t\tdev_err(cbdr->dev,\n \t\t\t\"%s: query EID 0x%x doesn't match response EID 0x%x\\n\",\n \t\t\tntmp_table_name(tbl_id), entry_id, le32_to_cpu(resp->entry_id));\n \t\treturn -EIO;\n@@ -312,15 +343,15 @@ static int ntmp_query_entry_by_id(struct ntmp_user *user, int tbl_id,\n int ntmp_maft_add_entry(struct ntmp_user *user, u32 entry_id,\n \t\t\tstruct maft_entry_data *maft)\n {\n-\tstruct ntmp_dma_buf data = {\n-\t\t.dev = user->dev,\n+\tstruct netc_swcbd swcbd = {\n \t\t.size = sizeof(struct maft_req_add),\n \t};\n \tstruct maft_req_add *req;\n+\tstruct netc_cbdr *cbdr;\n \tunion netc_cbd cbd;\n \tint err;\n \n-\terr = ntmp_alloc_data_mem(&data, (void **)&req);\n+\terr = ntmp_alloc_data_mem(user->dev, &swcbd, (void **)&req);\n \tif (err)\n \t\treturn err;\n \n@@ -329,14 +360,15 @@ int ntmp_maft_add_entry(struct ntmp_user *user, u32 entry_id,\n \treq->keye = maft->keye;\n \treq->cfge = maft->cfge;\n \n-\tntmp_fill_request_hdr(&cbd, data.dma, NTMP_LEN(data.size, 0),\n+\tntmp_fill_request_hdr(&cbd, swcbd.dma, NTMP_LEN(swcbd.size, 0),\n \t\t\t NTMP_MAFT_ID, NTMP_CMD_ADD, NTMP_AM_ENTRY_ID);\n-\terr = netc_xmit_ntmp_cmd(user, &cbd);\n+\n+\tntmp_select_and_lock_cbdr(user, &cbdr);\n+\terr = netc_xmit_ntmp_cmd(cbdr, &cbd, &swcbd);\n \tif (err)\n \t\tdev_err(user->dev, \"Failed to add MAFT entry 0x%x, err: %pe\\n\",\n \t\t\tentry_id, ERR_PTR(err));\n-\n-\tntmp_free_data_mem(&data);\n+\tntmp_unlock_cbdr(cbdr);\n \n \treturn err;\n }\n@@ -345,31 +377,31 @@ EXPORT_SYMBOL_GPL(ntmp_maft_add_entry);\n int ntmp_maft_query_entry(struct ntmp_user *user, u32 entry_id,\n \t\t\t struct maft_entry_data *maft)\n {\n-\tstruct ntmp_dma_buf data = {\n-\t\t.dev = user->dev,\n+\tstruct netc_swcbd swcbd = {\n \t\t.size = sizeof(struct maft_resp_query),\n \t};\n \tstruct maft_resp_query *resp;\n \tstruct ntmp_req_by_eid *req;\n+\tstruct netc_cbdr *cbdr;\n \tint err;\n \n-\terr = ntmp_alloc_data_mem(&data, (void **)&req);\n+\terr = ntmp_alloc_data_mem(user->dev, &swcbd, (void **)&req);\n \tif (err)\n \t\treturn err;\n \n \tntmp_fill_crd_eid(req, user->tbl.maft_ver, 0, 0, entry_id);\n-\terr = ntmp_query_entry_by_id(user, NTMP_MAFT_ID,\n-\t\t\t\t NTMP_LEN(sizeof(*req), data.size),\n-\t\t\t\t req, data.dma, true);\n+\n+\tntmp_select_and_lock_cbdr(user, &cbdr);\n+\terr = ntmp_query_entry_by_id(cbdr, NTMP_MAFT_ID, req, &swcbd, true);\n \tif (err)\n-\t\tgoto end;\n+\t\tgoto unlock_cbdr;\n \n \tresp = (struct maft_resp_query *)req;\n \tmaft->keye = resp->keye;\n \tmaft->cfge = resp->cfge;\n \n-end:\n-\tntmp_free_data_mem(&data);\n+unlock_cbdr:\n+\tntmp_unlock_cbdr(cbdr);\n \n \treturn err;\n }\n@@ -385,8 +417,9 @@ EXPORT_SYMBOL_GPL(ntmp_maft_delete_entry);\n int ntmp_rsst_update_entry(struct ntmp_user *user, const u32 *table,\n \t\t\t int count)\n {\n-\tstruct ntmp_dma_buf data = {.dev = user->dev};\n \tstruct rsst_req_update *req;\n+\tstruct netc_swcbd swcbd;\n+\tstruct netc_cbdr *cbdr;\n \tunion netc_cbd cbd;\n \tint err, i;\n \n@@ -394,8 +427,8 @@ int ntmp_rsst_update_entry(struct ntmp_user *user, const u32 *table,\n \t\t/* HW only takes in a full 64 entry table */\n \t\treturn -EINVAL;\n \n-\tdata.size = struct_size(req, groups, count);\n-\terr = ntmp_alloc_data_mem(&data, (void **)&req);\n+\tswcbd.size = struct_size(req, groups, count);\n+\terr = ntmp_alloc_data_mem(user->dev, &swcbd, (void **)&req);\n \tif (err)\n \t\treturn err;\n \n@@ -405,15 +438,15 @@ int ntmp_rsst_update_entry(struct ntmp_user *user, const u32 *table,\n \tfor (i = 0; i < count; i++)\n \t\treq->groups[i] = (u8)(table[i]);\n \n-\tntmp_fill_request_hdr(&cbd, data.dma, NTMP_LEN(data.size, 0),\n+\tntmp_fill_request_hdr(&cbd, swcbd.dma, NTMP_LEN(swcbd.size, 0),\n \t\t\t NTMP_RSST_ID, NTMP_CMD_UPDATE, NTMP_AM_ENTRY_ID);\n \n-\terr = netc_xmit_ntmp_cmd(user, &cbd);\n+\tntmp_select_and_lock_cbdr(user, &cbdr);\n+\terr = netc_xmit_ntmp_cmd(cbdr, &cbd, &swcbd);\n \tif (err)\n \t\tdev_err(user->dev, \"Failed to update RSST entry, err: %pe\\n\",\n \t\t\tERR_PTR(err));\n-\n-\tntmp_free_data_mem(&data);\n+\tntmp_unlock_cbdr(cbdr);\n \n \treturn err;\n }\n@@ -421,8 +454,9 @@ EXPORT_SYMBOL_GPL(ntmp_rsst_update_entry);\n \n int ntmp_rsst_query_entry(struct ntmp_user *user, u32 *table, int count)\n {\n-\tstruct ntmp_dma_buf data = {.dev = user->dev};\n \tstruct ntmp_req_by_eid *req;\n+\tstruct netc_swcbd swcbd;\n+\tstruct netc_cbdr *cbdr;\n \tunion netc_cbd cbd;\n \tint err, i;\n \tu8 *group;\n@@ -431,21 +465,23 @@ int ntmp_rsst_query_entry(struct ntmp_user *user, u32 *table, int count)\n \t\t/* HW only takes in a full 64 entry table */\n \t\treturn -EINVAL;\n \n-\tdata.size = NTMP_ENTRY_ID_SIZE + RSST_STSE_DATA_SIZE(count) +\n-\t\t RSST_CFGE_DATA_SIZE(count);\n-\terr = ntmp_alloc_data_mem(&data, (void **)&req);\n+\tswcbd.size = NTMP_ENTRY_ID_SIZE + RSST_STSE_DATA_SIZE(count) +\n+\t\t RSST_CFGE_DATA_SIZE(count);\n+\terr = ntmp_alloc_data_mem(user->dev, &swcbd, (void **)&req);\n \tif (err)\n \t\treturn err;\n \n \t/* Set the request data buffer */\n \tntmp_fill_crd_eid(req, user->tbl.rsst_ver, 0, 0, 0);\n-\tntmp_fill_request_hdr(&cbd, data.dma, NTMP_LEN(sizeof(*req), data.size),\n+\tntmp_fill_request_hdr(&cbd, swcbd.dma, NTMP_LEN(sizeof(*req), swcbd.size),\n \t\t\t NTMP_RSST_ID, NTMP_CMD_QUERY, NTMP_AM_ENTRY_ID);\n-\terr = netc_xmit_ntmp_cmd(user, &cbd);\n+\n+\tntmp_select_and_lock_cbdr(user, &cbdr);\n+\terr = netc_xmit_ntmp_cmd(cbdr, &cbd, &swcbd);\n \tif (err) {\n \t\tdev_err(user->dev, \"Failed to query RSST entry, err: %pe\\n\",\n \t\t\tERR_PTR(err));\n-\t\tgoto end;\n+\t\tgoto unlock_cbdr;\n \t}\n \n \tgroup = (u8 *)req;\n@@ -453,8 +489,8 @@ int ntmp_rsst_query_entry(struct ntmp_user *user, u32 *table, int count)\n \tfor (i = 0; i < count; i++)\n \t\ttable[i] = group[i];\n \n-end:\n-\tntmp_free_data_mem(&data);\n+unlock_cbdr:\n+\tntmp_unlock_cbdr(cbdr);\n \n \treturn err;\n }\ndiff --git a/drivers/net/ethernet/freescale/enetc/ntmp_private.h b/drivers/net/ethernet/freescale/enetc/ntmp_private.h\nindex 3459cc45b610..f8dff3ba2c28 100644\n--- a/drivers/net/ethernet/freescale/enetc/ntmp_private.h\n+++ b/drivers/net/ethernet/freescale/enetc/ntmp_private.h\n@@ -14,6 +14,7 @@\n #define NETC_CBDR_BD_NUM\t256\n #define NETC_CBDRCIR_INDEX\tGENMASK(9, 0)\n #define NETC_CBDRCIR_SBE\tBIT(31)\n+#define NETC_CBDR_CLEAN_WORK\t16\n \n union netc_cbd {\n \tstruct {\n@@ -56,13 +57,6 @@ union netc_cbd {\n \t} resp_hdr; /* NTMP Response Message Header Format */\n };\n \n-struct ntmp_dma_buf {\n-\tstruct device *dev;\n-\tsize_t size;\n-\tvoid *buf;\n-\tdma_addr_t dma;\n-};\n-\n struct ntmp_cmn_req_data {\n \t__le16 update_act;\n \tu8 dbg_opt;\ndiff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h\nindex 916dc4fe7de3..83a449b4d6ec 100644\n--- a/include/linux/fsl/ntmp.h\n+++ b/include/linux/fsl/ntmp.h\n@@ -31,6 +31,12 @@ struct netc_tbl_vers {\n \tu8 rsst_ver;\n };\n \n+struct netc_swcbd {\n+\tvoid *buf;\n+\tdma_addr_t dma;\n+\tsize_t size;\n+};\n+\n struct netc_cbdr {\n \tstruct device *dev;\n \tstruct netc_cbdr_regs regs;\n@@ -44,9 +50,10 @@ struct netc_cbdr {\n \tvoid *addr_base_align;\n \tdma_addr_t dma_base;\n \tdma_addr_t dma_base_align;\n+\tstruct netc_swcbd *swcbd;\n \n \t/* Serialize the order of command BD ring */\n-\tspinlock_t ring_lock;\n+\tstruct mutex ring_lock;\n };\n \n struct ntmp_user {\n", "prefixes": [ "v2", "net", "2/2" ] }