From patchwork Fri Jun 18 10:52:33 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Esben Haabendal X-Patchwork-Id: 12331023 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C6F2C48BDF for ; Fri, 18 Jun 2021 10:54:38 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CA78060FF0 for ; Fri, 18 Jun 2021 10:54:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CA78060FF0 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=geanix.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=xFH3+y3189FnGQi/v9EAgfU1yl9gGTzYaB1XakCRQ1k=; b=KnCT7tDoYhbSuu 4XogFFPLAuRNpYtp6UYPYZgOUvXniKA0GcNPXbM+HoDEMT9jXeFfKmt70svi9eE6Irt4G/2FvPf6O QviMJzkWKJVVMsuHrMfc2WD4JFgVvMG1iIawZUtKqZogb7AXPgJgBQYj6LylW4NVVdPHfAw7sX6/G hZAa9FQF48tQ8+2SOGQCgOiA1K7pZAAr3U39slOjQIrURETD5fDIXsiJBWRPzZ15XALMKAWYMmH2p HUuCoxk9SdGWvXe1Z6irJ+PoZat7BoRhMHRKA89pjJqxhASsRKzUAMkc4wJuASkAMlFKmUCHeIq/x XpEdt94d7d/nqWpcSYEw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1luC7Q-00DntO-OX; Fri, 18 Jun 2021 10:53:00 +0000 Received: from first.geanix.com ([116.203.34.67]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1luC74-00DnnX-43 for linux-arm-kernel@lists.infradead.org; Fri, 18 Jun 2021 10:52:39 +0000 Received: from localhost (80-62-117-165-mobile.dk.customer.tdc.net [80.62.117.165]) by first.geanix.com (Postfix) with ESMTPSA id D0211C7E; Fri, 18 Jun 2021 10:52:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=geanix.com; s=first; t=1624013555; bh=WHjjMsx6IxEstOT3uD0IXWYEPbXsz31jeGej/RXoWTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QTkZesMk+VQJ/TaLOlvwsOqRex89lIIwouZEMP09F7AHOMUGQhl4C0mzkW3pLpUtt q2IMxe5iILEwaD6XxAJQ+1n3wbelxPfnbVWjXjXVhaCAR7kpgRm4t2RqOtVC9OiJmH nR8vDtMYb7kmibBFvJ45o96LGzb+edzEleyi5hfCJABUQPriAKp8B8BdFx1ezQOOxx G9U3S7ZFcp+C7/kyyhwGcD2P5qwap31fb2dvQmLHFgan16OhlbUjZ0aqSd8mSBIY7n zDYpRSthHu7NF8QIWO0I3zurTKJXBWQfpOsqICettfTCdu3+FGj1L6lBHEIuL/45jB Hs08rC0+4lWIA== From: Esben Haabendal To: netdev@vger.kernel.org Cc: stable@vger.kernel.org, "David S. Miller" , Jakub Kicinski , Michal Simek , Zhang Changzhong , Jesse Brandeburg , Andrew Lunn , Wang Hai , Michael Walle , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/4] net: ll_temac: Fix TX BD buffer overwrite Date: Fri, 18 Jun 2021 12:52:33 +0200 Message-Id: X-Mailer: git-send-email 2.32.0 In-Reply-To: References: MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210618_035238_388538_1FC77716 X-CRM114-Status: GOOD ( 12.08 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Just as the initial check, we need to ensure num_frag+1 buffers available, as that is the number of buffers we are going to use. This fixes a buffer overflow, which might be seen during heavy network load. Complete lockup of TEMAC was reproducible within about 10 minutes of a particular load. Fixes: 84823ff80f74 ("net: ll_temac: Fix race condition causing TX hang") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Esben Haabendal --- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c index 9797aa3221d1..cc482ee36501 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -861,7 +861,7 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) smp_mb(); /* Space might have just been freed - check again */ - if (temac_check_tx_bd_space(lp, num_frag)) + if (temac_check_tx_bd_space(lp, num_frag + 1)) return NETDEV_TX_BUSY; netif_wake_queue(ndev);