From patchwork Fri Dec 6 19:00:12 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897585 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f182.google.com (mail-lj1-f182.google.com [209.85.208.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E395117B502 for ; Fri, 6 Dec 2024 19:00:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511647; cv=none; b=rGVcXiKQtv0rHjH5Ij4RYnd4CGpDtAoXMJNhOv8C9L/m4PHNPI3suPKfYPwLpCzMH4fCJ4rLwhuVrwyU0gyZxoqVTRoYsh9THV2ck9H+LiYb3FgG3WMNqAI67FpnzRA7asjoHVMhzm1POjevOeQE7qdy4lqCDjzB/g4r0e0Dd8E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511647; c=relaxed/simple; bh=SI27lQ6ouPyc6VSvj6mijRBvLjbpSdfHHV2X5cxHAlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=k6hzoH4bxGV5uQvLDTf2JK9g48knKwfp0nOorOPSTLhqxWQM+jvwTXHUuwO4gImJmFt4P07+k4zrgrdhiMVpTic21PwHPBOIyfN9ahRCvgtDk53ri21E9gB8ZHh7MvYInWM+4iyNi92vTGFz6YGLpEhooogVPOXvJtbInzRaDWs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=An9K38cC; arc=none smtp.client-ip=209.85.208.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="An9K38cC" Received: by mail-lj1-f182.google.com with SMTP id 38308e7fff4ca-2ffbfee94d7so19815231fa.3 for ; Fri, 06 Dec 2024 11:00:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511643; x=1734116443; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=An9K38cCeebXwLpU8bCqmEJrBomOqrqLyAEbSNfU5B1LcVFGHGcoTePkagOr9EooU+ ztKAPCweLgsy27AP1Rzz64gf2Iy8pl8uUv+1twRJ2O+gKY+a0jYaHQ++Fn/yBikwAtjM vFuwi5irPwKRVd9L+4pAP2HcCv1J5uwFjkwLEXQVvq5bs1T27WiWPfs6AXPLWDEutQLP SJwpsErk307MnFV/g+wN3GtDb4f3G5h/FUHjfj/Wlqx2v9DifPtQGBCbikm7iIJQX1gw fxGRuw1sAsPHw6Tqq4OiLETw+ewIj4h76o1dUXpdTVxZnUjBVCdCQN6A5Sx5z7LLnbAD d4Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511643; x=1734116443; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=N/zGzVmiJmF25ZcWKmfCtvNoTY8yZllTvc2DTSV4GREe0QicQCI3iXTkmeO9V1jJdR /kDMlroYxAQyjQY6gTQPyZZ7ksOrBgjokd+gI8PyZrIuJECIigi3QoBYLB1J0pv0P3mp Ntp/R9ZrxErhJNMAmsj2R1E+ju1cdxa5nwHv6vXJmHWmAQVviAOTdbXV/25Bfdjwsvyu PH8KRDSGoTLkrNkrI6VaF4xj1LzaoUJEgRnJm5XBlCihM5RGybbp3PA/BSQritCWIhZl v+FvNuk3CrElPGZXDv6HRioyfq4mK5mWG1J0si5RzINJJn3qXi/r8afOeOw3/RKWOOwk TSpg== X-Gm-Message-State: AOJu0YwmfLJM73zn+OctVhml8dU3ztD3veEmiVdpmJWDnJL3xDP5XEbn xPzmSuTh9fzlOPtymduBn7IF7HrP5iIoOo7WRIJsS8LTEBkf0AmMKSyDekM1d/g= X-Gm-Gg: ASbGncttB+UQSBBxNbuw8yjR8NKSy+G7OWl6O/JGBFqYnf09FVNfD3Mlq5etze0nCjr LRwwxLueI4TKkyZ4RaKI6By1jj0xR1SDqyHyOQ8WTTvOZrs5XA2bEBm0qunYmho+cDsG6dI7Fh/ /I93wjjETb5qADvsDIMYFh1aHTjMBPiQAJmYMVmO7ZAi8qC328OTj6YCC7Y2Oc3/W5UgWJxaD60 sVN5TjGIKzk6qM2WsGtsybxIOZtB9/9TEZ9Gfn51oewRtWpAoF5L+PZOellPa3a X-Google-Smtp-Source: AGHT+IEW2UU+jTNoTOcEYuuCfhMKM2BI21VZcY54iVxmn2QTSlWVK53wH/yWJXy8oWjj5yDpAga4hA== X-Received: by 2002:a2e:a98e:0:b0:2ff:8f5f:1adf with SMTP id 38308e7fff4ca-3002f795a90mr13121781fa.5.1733511643070; Fri, 06 Dec 2024 11:00:43 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:42 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 1/4] net: renesas: rswitch: fix possible early skb release Date: Sat, 7 Dec 2024 00:00:12 +0500 Message-Id: <20241206190015.4194153-2-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index b80aa27a7214..32b32aa7e01f 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1681,8 +1681,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; - gq->skbs[gq->cur] = skb; - gq->unmap_addrs[gq->cur] = dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardware completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { From patchwork Fri Dec 6 19:00:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897586 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f174.google.com (mail-lj1-f174.google.com [209.85.208.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1E631FFC4E for ; Fri, 6 Dec 2024 19:00:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511648; cv=none; b=puSVipZ3+r+fZ1Qtj9r0XM85A2sdXj7CZkEtZ7OrJHgsGBUdKO8RXy53szF0cLu7/uHTMS5I+ECvM+3qgyFFKiTdZP9eLm9rUWaryKYmGoCfaiAoUmSfzvXjfg7YCsEj0CmqgAHlCkvtZ1UEVo7C1bPQyKEk0xpCtbxqArca0QI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511648; c=relaxed/simple; bh=b5jXhaNolTyyvrbjKKxRcvCAJp8P/hsnV5mqr6x9R1Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Ns1Ei9Qt++upN+uqtdfIuYSyGaKe2niPU/9zHQsgpJeGvO6+rcGpg9mgtyb5AKsv+lbHIag8c2QmbibqNfHM7it98DKq/77iOBxqi+0HDFJZ1AshrgROmffnryrX94TSL0iZy7fGtJouC/8+Ou8IJv8rYJbeSFy3GWzCA7QgwEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=XRyJBV5r; arc=none smtp.client-ip=209.85.208.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="XRyJBV5r" Received: by mail-lj1-f174.google.com with SMTP id 38308e7fff4ca-2ffa8df8850so28183061fa.3 for ; Fri, 06 Dec 2024 11:00:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511645; x=1734116445; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=U6OmUl/hmI7+OxMAFAfIf+jIYSG9pd6PU033H69utPY=; b=XRyJBV5r5naGO6NKYhqVdJ1aD41SPwRTObnU+SV6/NfOjJDykNY6Bo+ydj5kUjMuZs 0uT5TX16HjBY34lB7Mu6iV0uVeofnX4zfgowjzPQ7SBgZVr2lStVSRXJS7ZVmgFZnZDX 8ScRIS3kTXBtNiGgDsOid1y3nxeQxzC7+P78iHR68t8lRxhjPJJULAx25mMcPydWDIxl du6U3Q4TCqiHEXhaH5wso9j0WXhptPUIlpfuh3wUUNNC0l/csE3RSdth1ARqF2xW3ZwY eB4k2/unOTf/uRrJuIZg/Uxk+7b4NDtFOvnK3hcYyNmwX5djLN9QgmKk4ls/lnWKWD/D 6rKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511645; x=1734116445; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=U6OmUl/hmI7+OxMAFAfIf+jIYSG9pd6PU033H69utPY=; b=TxATWHueAYXJbcoSOasAqBTZ35xVWOo6Ns9SJOK3N2aSjpCNFN9/I3Ex0B/SkEN1AE W9EsPJsKPpECeabn5zs5ELobZW0iPycAO+AE9WdNre0No1ml5/nn5eO/Z2pip0Zue0P6 5wzwKCbfKjCKD3MgopJi+GpN0V0QETrIwXlgAvo8CgA1vf9eGBgMYqlrAlr9EFLHUBGP meYBcLbGvfCgwlZN/pb3tLdQORj4FbjJsH2HYA0rC1TSYEcXQZf+/UuUFPGbe55JZ6KX f2dK8KOdu9GFgjeLGElHT+OLfQ8VkpIUTd/j8Jt8x6YE000g+cHIUsh76alhaL/smxni sroA== X-Gm-Message-State: AOJu0YxTo/pgNhuiaoAOuScDGb+kvYRR9Wwapsx4Iy3NI6UPX8rgmuqf 6NWbAZzZdiKPb63InNJFFK3kUnLBb3Kdfd78ihiVzE8J1ZsHTAmixzefHGSxvqw= X-Gm-Gg: ASbGncsT9bsAOiMJloRoK2O92VT6HnlkbaiEKJZIbOp5yW2xY9HWhKv8M3TrjYzKqxC jqtOuVQBbhnxeUItbaVhv3Seu8Z6utTWgTpZKtapX5lXQXXgctTS9/fpiCpZ2PpXJXcFAJtXtre Bt2/sVuPXd48eC4xo8rwj6ALuKp98kajL3BZDVKlF8s9XtZB0ZBK7GpgUrXmlBEUg9VIYJKZbCx UyW05lnttd6QEG2g3I98+O3yTV7I5/RXL1iOkjgAQovNiYLvcYwjymzlC3TOvOL X-Google-Smtp-Source: AGHT+IG27wfeYMQbSTxDwOz7Jah13F/6degbx6OGNBuq2fRCCebyOoNgchqtp/MSVdvmUbDhxY2IGg== X-Received: by 2002:a05:651c:1586:b0:300:3e66:5881 with SMTP id 38308e7fff4ca-3003e6658cfmr4086831fa.7.1733511644842; Fri, 06 Dec 2024 11:00:44 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:44 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sat, 7 Dec 2024 00:00:13 +0500 Message-Id: <20241206190015.4194153-3-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 32b32aa7e01f..800744a6c25b 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty = rswitch_next_queue_index(gq, false, 1)) { - desc = &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) != DT_FEMPTY) - break; - + desc = &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) == DT_FEMPTY) { dma_rmb(); + skb = gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] = NULL; } + desc->desc.die_dt = DT_EEMPTY; + gq->dirty = rswitch_next_queue_index(gq, false, 1); + desc = &gq->tx_ring[gq->dirty]; } } @@ -1685,6 +1685,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; + dma_wmb(); /* ensure that hw won't start and complete before + skb pointer was saved */ + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { desc = &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1698,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd goto err_unmap; } - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur = rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); From patchwork Fri Dec 6 19:00:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897587 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68BD2204575 for ; Fri, 6 Dec 2024 19:00:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511651; cv=none; b=PmLpCwaPGsrt2OGmOQm6hEghsOpgqiJa/xOJgWiCq/VIjNRJXQy9EJxE2kWiY+cbbA1o0gSqVdzzo3RIRvQJOTqgRLSFcyKSYHILF45n0Rogddi/sguzxuAme+uqwWeq9UFTKqbVaI3DiqbaBH2lzD1H2xDnALT79oq411ZuTzc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511651; c=relaxed/simple; bh=KWMNtKFHSXqIJRHh07Fhy/LOB/evmZgba6wRNVyYg70=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=HOt94pNFRuNN6XLdbZWR9E/cXd3kl192N67vGSrCRV3gbDmOK24NW1iRMkOPDfcYip/WouPdkLB6qK3Cd2166WplNiohkUYkCP0Zj1WVojI/aQTokyvxURNg5wAeB/F+relMpuxTQNb0d0FW7oBeQhldYov7YAb+6RN/bR+U1Bs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=AaKeSLfv; arc=none smtp.client-ip=209.85.208.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="AaKeSLfv" Received: by mail-lj1-f179.google.com with SMTP id 38308e7fff4ca-2ffa974b2b0so21769251fa.3 for ; Fri, 06 Dec 2024 11:00:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511647; x=1734116447; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=i2QojkySpM8U2FoZ7dctDq5YFcwKebuv3WnOzhKxOok=; b=AaKeSLfvAuYARQhOkn8ve0wlftNC3sC4ypk8JATHhwRbT06adA4sEHbDxd8YS3B28S mghGDaUCR1vHjKf3lrNzzBaG+NCBEScUvZg66xGYtsvT45/np4RPkXpjqEGAAMS10KHz hVg9pkvb7tNwTcXU9fYL07Sas/g9B6ndgGwZa7Oc6fBpOJlhVQrTYfPgu9fLhzqr/0SU 7HNZHM+Otz6zC5l/5D3MMxPhh6o1koCSubufpkIZ6W3Od+as8eM51326nZlXRvmP490p J0gdAQHgQ+6fc9TyfKGllHvk6P1/GJSIa8Oi5OL/gKPPmt5JsmSucpte1FmlZSEtOpED KtyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511647; x=1734116447; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=i2QojkySpM8U2FoZ7dctDq5YFcwKebuv3WnOzhKxOok=; b=VhqMlf0CacLHcViRLdUSA+kFs1KgQUIpYMY0e3FST/46qyDcaxGdypgSxprcKe/F0h 7DBRjLagcrH6zHYwV4s+083i+kDAOnQAofpygSsZTSsjkKTWb5ollYO19vqp5ultsAXb hn31e0p2QXEjQYa1WMTYAI7xIeagTuw9VMb8RAhLXfetymNG7vJLbvORYqGmJRRuydhm lR+tP9yBbP8Vy1LNCOMR0JhR8XFEyyhgR27j9g8xv9AV0lzplVwWeUt/V1aVSCddqiEH 4LTG7v+CGPfbvK0F4XKlNZKdyRF0H0UlVyGdyHglGWhH8NOfZtU4SH74CTaffVx83+Zv BxJw== X-Gm-Message-State: AOJu0YwSCC4j8CZ7I0VwkeRs3YuUx6aZFh7tDEPDctJCE7GvGgF3KA1M rsthhev3kxewZa5ozfjXQqS4nH9R2pMVA48YCt6U95sczsdDlS0I4u7es0zX1SA= X-Gm-Gg: ASbGnctF3BSShHTPkjvfoL/hCPpXbZUWE2EzZiVt51k+wy8mRcvagIXiBPQwwPEvYaj WEhkYQYMPWBB1SIE7uZRRidbCbn+tW/yXm6I4v+CQIel4gRXCcnxQ5RQClu3/Y3WmTXAoYFwXAD lRD7/DGPRmIKlrCepWwYYjRJ1e0mnIuWoyD9HNgeADvdmCMkbb4QM5iOivJW9TSpxfheukDEmPv Vbk98X7gz70KSEfWll4cVF74hXoH2ljx1HYIBGGHUSHCXsjGD1e8qYgN8amV+yo X-Google-Smtp-Source: AGHT+IEIsm4wQVX3IM84rN3fxaWi6YpUjvzeeTe6nAk1y92eqqKLDaXUQfpaQtMa2bkKEiL1wi3iHg== X-Received: by 2002:a2e:bd14:0:b0:300:2278:9b1f with SMTP id 38308e7fff4ca-3002fd1b175mr15585421fa.39.1733511646671; Fri, 06 Dec 2024 11:00:46 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:46 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 3/4] net: renesas: rswitch: fix leaked pointer on error path Date: Sat, 7 Dec 2024 00:00:14 +0500 Message-Id: <20241206190015.4194153-4-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If error path is taken while filling descriptor for a frame, skb pointer is left in the entry. Later, on the ring entry reuse, the same entry could be used as a part of a multi-descriptor frame, and skb for that new frame could be stored in a different entry. Then, the stale pointer will reach the completion routine, and passed to the release operation. Fix that by clearing the saved skb pointer at the error path. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 800744a6c25b..9c55f3480678 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1704,6 +1704,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd return ret; err_unmap: + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = NULL; dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE); err_kfree: From patchwork Fri Dec 6 19:00:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897588 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f170.google.com (mail-lj1-f170.google.com [209.85.208.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5273320626B for ; Fri, 6 Dec 2024 19:00:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511652; cv=none; b=Ycsr3+9D/KRcJLKyCee7rvtb9L/d8RyL89PKsRlv0BN1Xqk1o9iP71WHeuSBHuE/qgTO2Eb5ZFYLTInXbe8e9kEB8/mZ4Q+gJ0F1eINKtDTmugbeF99W4VMbrvRunok5cIuoYr25giVsmzGX9uUoptCKpIQ9IqkDjBjP85cUEzA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511652; c=relaxed/simple; bh=Oug/7vDlEmuLkveQoKotO5NLIXni795nVP0v+lTs4CA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ULBoVsY7yqjVCrEDmKzNOWVpnIUakjlXz8OKbHSrUTLAUbIVyL702R1EiP6M6yjFFBSDkUbaVp7gvjfDIMzMJT+M5X0ybb8726h7QQ7Hjt0r7cFVPZHPRqP04IqPrQ3JkO8biCzi/ADojccujIPGXaPRTuYNQGQ/YtpZ901ZVDg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=I29150/l; arc=none smtp.client-ip=209.85.208.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="I29150/l" Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-3003c0c43c0so5190991fa.1 for ; Fri, 06 Dec 2024 11:00:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511648; x=1734116448; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NRtfoUuaiSmawV3D7PM8LTv0BVbgF0vB56WhOBoL48I=; b=I29150/l5AMSvygq3eX4FGWfKPNihBpQA0nMV66C2E3x1KYlSmxXPmBOaNKQGpDeji Y06PhD+v5If38T6CvvXmhm5hvTSAwcrQ+mvFGhUZLMduRx6lF6SSxxpvtN4wBYFt3esU Ec/K/x6NxsQOB/1iVOEKlMNRu0hWmwQkl6UOURgVKFL7S/OJIHr4PC3NtVY+SacmRAPF kAmr5hgd4cfkSUfYGedSgUKSzqFEOkp18d2mWqn/uluatfx+cB4R7yTRRhweftPl8qfB oRCuxqehyRBiQWlxwqesMN/t+dAkHokqVIlEAMRzh7iF46K8UrCuPqGhcTCeyJdlegZq 21NA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511648; x=1734116448; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NRtfoUuaiSmawV3D7PM8LTv0BVbgF0vB56WhOBoL48I=; b=VzStSQrTnyPPVRgnHXlMjcjMwLT7wsNr9D6acDG0ywP3eY7fbtVLo/BjWcQYRv0XJR 5XZDT0KLf5c9iJeArE/JqV3XKKA9S3+dacfe2GXXB5k+l2tmnepaPVMMgRN2Bz+J7PJP Nqbj9ZKi1kzODROlpxEWcNHSl9CSkG4E41oCPw/br3zz7CTTKroIZOloNFLWEZyfyDlQ j5kgQhYnAaJh5I3uZQUAJpgtYsLJz44JqigFECKG8WMgc147JO+D7DVnCvLLSvYXLDxw q6csqCvb4fAUpTKjqCHWg/ua+H5do7sGKaUokmcZlTFl6jPtBJc/cNhanHbZ96Mj20al HAsA== X-Gm-Message-State: AOJu0YyYsSX8jIEN7qAN5DynVXeehItcikABQmwQdJiifSCB7vjIxfUb KE7YeQt992Gt+S8mHb4axhA6VvJrGnEJ5JPZhu9QQ6TAKibSYzLkcpIndxn8R4mQAMXgCASg8RK bwoo= X-Gm-Gg: ASbGncsWtCZoVvAPZpvMO8Nt2yLQ72iAJUWc8+sbGuCC2gEcULjoZ1oVwgrWZGCCCxR lynkPYjE9Sz5mypk50Xr27L9GhXLOCgrkZhNyr2gDAhVJg642ni7SGoROhalqUTTMm46j4FfC7y F/SQrR68vkYTqrlcmIgQTKdRDOUfTJxiRxqc+XLTOSumJyPMk+fRklMJjhSfMwT9nOluXLukS0M pWgcURnhbfdUOgsPZ3TA8nRj8ByYU52/LrPMSsbTeOYmqjf4jgxGiaagRxuQlhW X-Google-Smtp-Source: AGHT+IHHUgZX1u6gj5ZZhnbZvFvdFxtWjem7qzmC9NdGd/PDARE/4bpEVRG4Dg3PrMiq11s8UCNfVg== X-Received: by 2002:a2e:b88c:0:b0:300:3a15:8f26 with SMTP id 38308e7fff4ca-3003a1592e3mr14869321fa.0.1733511648446; Fri, 06 Dec 2024 11:00:48 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:48 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 4/4] net: renesas: rswitch: avoid use-after-put for a device tree node Date: Sat, 7 Dec 2024 00:00:15 +0500 Message-Id: <20241206190015.4194153-5-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 9c55f3480678..57cf211ac1e1 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1892,7 +1892,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1922,6 +1921,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1935,6 +1935,7 @@ static void rswitch_device_free(struct rswitch_private *priv, unsigned int index rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); }