Frames larger than the configured maximum legal length are still received, clipped at that length, and marked in the descriptor as an oversize error. mvneta_rx_error() already handles the error case, but the driver never releases the descriptor back to the ring: the next call starts from the same, already-handled descriptor instead of moving past it, and the receive queue never catches up.
Mark the descriptor as free the same way the success path right below it already does: one descriptor was looked at, so update the ring by one, matching the comment already in place on that path. Signed-off-by: Thomas Perrot <[email protected]> --- drivers/net/mvneta.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/mvneta.c b/drivers/net/mvneta.c index baa18202d6e2..3c0848fad7e0 100644 --- a/drivers/net/mvneta.c +++ b/drivers/net/mvneta.c @@ -1533,7 +1533,11 @@ static int mvneta_recv(struct udevice *dev, int flags, uchar **packetp) if (!mvneta_rxq_desc_is_first_last(rx_status) || (rx_status & MVNETA_RXD_ERR_SUMMARY)) { mvneta_rx_error(pp, rx_desc); - /* leave the descriptor untouched */ + /* + * Only mark one descriptor as free since only one + * was processed, same as the success path below + */ + mvneta_rxq_desc_num_update(pp, rxq, 1, 1); return -EIO; } --- base-commit: ece349ade2973e220f524ce59e59711cc919263f change-id: 20261010-tprrt-mvneta-rx-oversize-320f99f6b147 Best regards, -- Thomas Perrot <[email protected]>
