From patchwork Sun Feb 5 20:11:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jonas Suhr Christensen X-Patchwork-Id: 13129124 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 486AAC636CC for ; Sun, 5 Feb 2023 20:12:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229553AbjBEUMA (ORCPT ); Sun, 5 Feb 2023 15:12:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229540AbjBEUL7 (ORCPT ); Sun, 5 Feb 2023 15:11:59 -0500 Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EEE341BACF; Sun, 5 Feb 2023 12:11:56 -0800 (PST) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 5A9B55C01F5; Sun, 5 Feb 2023 15:11:56 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Sun, 05 Feb 2023 15:11:56 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umbraculum.org; h=cc:cc:content-transfer-encoding:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm2; t=1675627916; x= 1675714316; bh=hA3dCPmbSRjezrNAShgEdpiu7lZnljDCdF+ebyU75Mc=; b=X rpyY0ibRff82kZxjCR07DZM8l97UAL+cuBtEf7FlU9W0q7dhDOcOdTK2V8yHyeUL QB4QirwmFz/oEACLImPViizYz2qmqzlg609kAw/LIomX52i1mrmD/3Xn2zspNFH6 P2E5TQLTpqXfxevuXRxYQxlY38gis1wH5X0O+ZmpbBAcFpzLHQGweTRLRJJ0aMq3 PfZ7qqWKj+HDZcZ4nuw7WfcZD1K7ebfWV6glzolfgHx57+vEeJHIt13smbjlJX8t mPlk3ffY6zip3KgOZqA9iB16ObBIkDzF/jY9kiF+7hCtqWJlOTJf9UZiOWK2sRll EIWfuppFzHgDXDuO4oesg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; t=1675627916; x=1675714316; bh=hA3dCPmbSRjez rNAShgEdpiu7lZnljDCdF+ebyU75Mc=; b=U06os4K0gcRBVtqN+2+EQRYaZmYUp CkOosO2+A4mwYAqSRJlZkGAvOFQRm92Nptew/WeABgHHDBrD69ShAhm30A+Y0YpY iX+Ww8AfnLiwbtpXozjohasUU4NwQOk7w0nhCVKoXSeTACHlQWH5dSIz0xqT0gT3 v9jEmR2rmZjnYaINAhkcoLZQDnLzjqlzSFCY477uhKHLXRJAlJxMaSVy8peEdkhE pPbzGbCTAZnDr6zYCT54s2obie84XHNOOT8SLscyPiXb7dtBVWlk0rl+9MXKTc8s t08oGMzphvzPGk7zRoOn/GtVDm2qg+vAyILfqAT4WEs1hql9eb99ZFx6Q== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrudeggedgudefgecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeflohhn rghsucfuuhhhrhcuvehhrhhishhtvghnshgvnhcuoehjshgtsehumhgsrhgrtghulhhumh drohhrgheqnecuggftrfgrthhtvghrnhepieevleeguedviefgfedtjeeuuddtjeekheff ueffhfejieevleffffekjeffgedunecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrg hmpehmrghilhhfrhhomhepjhhstgesuhhmsghrrggtuhhluhhmrdhorhhg X-ME-Proxy: Feedback-ID: i06314781:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 5 Feb 2023 15:11:53 -0500 (EST) From: Jonas Suhr Christensen To: netdev@vger.kernel.org Cc: jsc@umbraculum.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Michal Simek , Harini Katakam , Haoyue Xu , huangjunxian , Wang Qing , Yang Yingliang , Esben Haabendal , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH net v2 1/2] net: ll_temac: Fix DMA resources leak Date: Sun, 5 Feb 2023 21:11:27 +0100 Message-Id: <20230205201130.11303-2-jsc@umbraculum.org> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230205201130.11303-1-jsc@umbraculum.org> References: <20230205201130.11303-1-jsc@umbraculum.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org Add missing conversion of address when unmapping dma region causing unmapping to silently fail. At some point resulting in buffer overrun eg. when releasing device. Fixes: fdd7454ecb29 ("net: ll_temac: Fix support for little-endian platforms") Signed-off-by: Jonas Suhr Christensen Reviewed-by: Harini Katakam Acked-by: Esben Haabendal --- drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c index 1066420d6a83..74423adbe50d 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -299,6 +299,7 @@ static int temac_dcr_setup(struct temac_local *lp, struct platform_device *op, static void temac_dma_bd_release(struct net_device *ndev) { struct temac_local *lp = netdev_priv(ndev); + struct cdmac_bd *bd; int i; /* Reset Local Link (DMA) */ @@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev) for (i = 0; i < lp->rx_bd_num; i++) { if (!lp->rx_skb[i]) break; - dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys, + + bd = &lp->rx_bd_v[i]; + dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys), XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE); + bd->phys = 0; + bd->len = 0; dev_kfree_skb(lp->rx_skb[i]); + lp->rx_skb[i] = NULL; } if (lp->rx_bd_v) dma_free_coherent(ndev->dev.parent, From patchwork Sun Feb 5 20:11:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jonas Suhr Christensen X-Patchwork-Id: 13129125 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3ED16C636CD for ; Sun, 5 Feb 2023 20:12:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229579AbjBEUMR (ORCPT ); Sun, 5 Feb 2023 15:12:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45120 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229605AbjBEUMP (ORCPT ); Sun, 5 Feb 2023 15:12:15 -0500 Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AB4DA1CAC2; Sun, 5 Feb 2023 12:12:06 -0800 (PST) Received: from compute6.internal (compute6.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id 12C005C0203; Sun, 5 Feb 2023 15:12:06 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute6.internal (MEProxy); Sun, 05 Feb 2023 15:12:06 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umbraculum.org; h=cc:cc:content-transfer-encoding:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm2; t=1675627926; x= 1675714326; bh=8VsSZkkMWRvOWY9tZMEtwmU5JOkYF2mh7pXIeChgG2k=; b=H C8dXG0Se47RIJ5bO3VHAWnq/HJZudqoLWuZa4DtftBAnHjJ8tYiERb+VMRkHkRMT ftHkKj36BpCDFaVJIq7U4QE+wQ71lje+ErsvratdtRHyh2HF/8c6twLyNlUKrYbg 1aUb7MmKhR6RzcMTNRUIJzYD5JpErH/h65tlhtbWvDkPc058aRjH3yv0fR7Z+uYZ u3S3YH0r17dclPXWsA10NIdA9xs5WZTEUlh1nty7gjrxVIDdeQlMYULpkeWWxb+z nR4Iomu4Yq/ReiRI/sC5OqnrfNKYjRcJMjyHV8zhNB45yWHsr3LzaT57B7ywrx6E ia/LUJ9OI5kenyHIjUbnw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; t=1675627926; x=1675714326; bh=8VsSZkkMWRvOW Y9tZMEtwmU5JOkYF2mh7pXIeChgG2k=; b=YFlgDVbNZHteGZ2l+rJyXJF6Vev9d NHdN9mfQUBoWOls0i73h/7xlmFMeWmlDUKAn5sfBsGgG8zwI4oHOuzLYWDhorNh0 0xBN62elFUYtPdicmkR8snyKE3jhja/jkxXHLDuXoiXPRiiJFPDZ2RMaeavIDkgT jMpWALeCGG09Sk1doQr8Yc/fOFkWr5FYU3pp01OcIkSjkoKE0cNEKq85nNiFaago 67XOaE9kS7Dt7DR0SsBA7H/o9HMoya+XvLOjrf8pq3y7pZ+3hDwp4+LgZcezTjWZ GlkiERW0scoq8ENX6upe6sTzlvZDYj5hnkCng5Hr+zpYzEhA4254ZRgdA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrudeggedgudefgecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeflohhn rghsucfuuhhhrhcuvehhrhhishhtvghnshgvnhcuoehjshgtsehumhgsrhgrtghulhhumh drohhrgheqnecuggftrfgrthhtvghrnhepieevleeguedviefgfedtjeeuuddtjeekheff ueffhfejieevleffffekjeffgedunecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrg hmpehmrghilhhfrhhomhepjhhstgesuhhmsghrrggtuhhluhhmrdhorhhg X-ME-Proxy: Feedback-ID: i06314781:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 5 Feb 2023 15:12:03 -0500 (EST) From: Jonas Suhr Christensen To: netdev@vger.kernel.org Cc: jsc@umbraculum.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Michal Simek , Harini Katakam , Haoyue Xu , huangjunxian , Christophe JAILLET , Yang Yingliang , Esben Haabendal , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH net v2 2/2] net: ll_temac: Reset buffer on dma_map_single() errors Date: Sun, 5 Feb 2023 21:11:28 +0100 Message-Id: <20230205201130.11303-3-jsc@umbraculum.org> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230205201130.11303-1-jsc@umbraculum.org> References: <20230205201130.11303-1-jsc@umbraculum.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org To avoid later calls to dma_unmap_single() on address' that fails to be mapped, free the allocated skb and set the pointer of the address to NULL. Eg. when a mapping fails temac_dma_bd_release() will try to call dma_unmap_single() on that address if the structure is not reset. Fixes: d07c849cd2b9 ("net: ll_temac: Add more error handling of dma_map_single() calls") Signed-off-by: Jonas Suhr Christensen Reviewed-by: Harini Katakam Acked-by: Esben Haabendal --- drivers/net/ethernet/xilinx/ll_temac_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c index 74423adbe50d..df43f5bc3bd3 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -376,8 +376,11 @@ static int temac_dma_bd_init(struct net_device *ndev) skb_dma_addr = dma_map_single(ndev->dev.parent, skb->data, XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE); - if (dma_mapping_error(ndev->dev.parent, skb_dma_addr)) + if (dma_mapping_error(ndev->dev.parent, skb_dma_addr)) { + dev_kfree_skb(lp->rx_skb[i]); + lp->rx_skb[i] = NULL; goto out; + } lp->rx_bd_v[i].phys = cpu_to_be32(skb_dma_addr); lp->rx_bd_v[i].len = cpu_to_be32(XTE_MAX_JUMBO_FRAME_SIZE); lp->rx_bd_v[i].app0 = cpu_to_be32(STS_CTRL_APP0_IRQONEND);