net: axienet: don't advance the TX ring head before the descriptor is ready

axienet_start_xmit_dmaengine() bumps lp->tx_ring_head before
skb_to_sgvec(), dma_map_sg() and device_prep_slave_sg(), and none of
their error paths undo it.  The skb is freed and nothing is submitted,
but the slot stays claimed.  axienet_dma_tx_cb() walks tx_ring_tail
once per completion, so the next completion lands on the abandoned slot
and dereferences whatever skb pointer is left there: NULL if the slot
was never used or was already completed, or a stale skb that gets
consumed a second time.  Every completion after that is accounted
against the wrong slot.

dma_map_sg() and device_prep_slave_sg() can fail at runtime, and so can
skb_to_sgvec() on a malformed skb.  Only advance tx_ring_head once
those have succeeded.  The completion callback can't run before
dmaengine_submit(), so claiming the slot just before that is fine.

dmaengine_submit() itself can also fail on xilinx_dma after a channel
error, and its return isn't checked either.  That's a separate problem
and isn't changed here.

This was found by the Sashiko AI review of the skbuff BUG_ON() series.

Cc: stable+noautosel@kernel.org # LLM report + LLM fix, untested
Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support")
Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f732895b@toxicpanda.com/
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261013-b4-axienet-dmaengine-ring-head-v1-1-7add24e74477@toxicpanda.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions