| Message ID | 20250415090543.717991-3-m-malladi@ti.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Bug fixes from XDP and perout series | expand |
On 4/15/2025 2:05 AM, Meghana Malladi wrote: > There is an error check inside emac_xmit_xdp_frame() function which > is called when the driver wants to transmit XDP frame, to check if > the allocated tx descriptor is NULL, if true to exit and return > ICSSG_XDP_CONSUMED implying failure in transmission. > > In this case trying to free a descriptor which is NULL will result > in kernel crash due to NULL pointer dereference. Fix this error handling > and increase netdev tx_dropped stats in the caller of this function > if the function returns ICSSG_XDP_CONSUMED. > > Fixes: 62aa3246f462 ("net: ti: icssg-prueth: Add XDP support") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Closes: https://lore.kernel.org/all/70d8dd76-0c76-42fc-8611-9884937c82f5@stanley.mountain/ > Signed-off-by: Meghana Malladi <m-malladi@ti.com> > Reviewed-by: Simon Horman <horms@kernel.org> > Reviewed-by: Roger Quadros <rogerq@kernel.org> > --- > Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> > Changes from v3 (v4-v3): > - Collected RB tag from Roger Quadros <rogerq@kernel.org> > > drivers/net/ethernet/ti/icssg/icssg_common.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/ti/icssg/icssg_common.c b/drivers/net/ethernet/ti/icssg/icssg_common.c > index ec643fb69d30..b4be76e13a2f 100644 > --- a/drivers/net/ethernet/ti/icssg/icssg_common.c > +++ b/drivers/net/ethernet/ti/icssg/icssg_common.c > @@ -583,7 +583,7 @@ u32 emac_xmit_xdp_frame(struct prueth_emac *emac, > first_desc = k3_cppi_desc_pool_alloc(tx_chn->desc_pool); > if (!first_desc) { > netdev_dbg(ndev, "xdp tx: failed to allocate descriptor\n"); > - goto drop_free_descs; /* drop */ > + return ICSSG_XDP_CONSUMED; /* drop */ > } > > if (page) { /* already DMA mapped by page_pool */ > @@ -671,8 +671,10 @@ static u32 emac_run_xdp(struct prueth_emac *emac, struct xdp_buff *xdp, > > q_idx = smp_processor_id() % emac->tx_ch_num; > result = emac_xmit_xdp_frame(emac, xdpf, page, q_idx); > - if (result == ICSSG_XDP_CONSUMED) > + if (result == ICSSG_XDP_CONSUMED) { > + ndev->stats.tx_dropped++; > goto drop; > + } > > dev_sw_netstats_rx_add(ndev, xdpf->len); > return result;
diff --git a/drivers/net/ethernet/ti/icssg/icssg_common.c b/drivers/net/ethernet/ti/icssg/icssg_common.c index ec643fb69d30..b4be76e13a2f 100644 --- a/drivers/net/ethernet/ti/icssg/icssg_common.c +++ b/drivers/net/ethernet/ti/icssg/icssg_common.c @@ -583,7 +583,7 @@ u32 emac_xmit_xdp_frame(struct prueth_emac *emac, first_desc = k3_cppi_desc_pool_alloc(tx_chn->desc_pool); if (!first_desc) { netdev_dbg(ndev, "xdp tx: failed to allocate descriptor\n"); - goto drop_free_descs; /* drop */ + return ICSSG_XDP_CONSUMED; /* drop */ } if (page) { /* already DMA mapped by page_pool */ @@ -671,8 +671,10 @@ static u32 emac_run_xdp(struct prueth_emac *emac, struct xdp_buff *xdp, q_idx = smp_processor_id() % emac->tx_ch_num; result = emac_xmit_xdp_frame(emac, xdpf, page, q_idx); - if (result == ICSSG_XDP_CONSUMED) + if (result == ICSSG_XDP_CONSUMED) { + ndev->stats.tx_dropped++; goto drop; + } dev_sw_netstats_rx_add(ndev, xdpf->len); return result;
There is an error check inside emac_xmit_xdp_frame() function which is called when the driver wants to transmit XDP frame, to check if the allocated tx descriptor is NULL, if true to exit and return ICSSG_XDP_CONSUMED implying failure in transmission. In this case trying to free a descriptor which is NULL will result in kernel crash due to NULL pointer dereference. Fix this error handling and increase netdev tx_dropped stats in the caller of this function if the function returns ICSSG_XDP_CONSUMED. Fixes: 62aa3246f462 ("net: ti: icssg-prueth: Add XDP support") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/all/70d8dd76-0c76-42fc-8611-9884937c82f5@stanley.mountain/ Signed-off-by: Meghana Malladi <m-malladi@ti.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Roger Quadros <rogerq@kernel.org> --- Changes from v3 (v4-v3): - Collected RB tag from Roger Quadros <rogerq@kernel.org> drivers/net/ethernet/ti/icssg/icssg_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)