From patchwork Sun Dec 8 09:50:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898521 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D1DD13B780 for ; Sun, 8 Dec 2024 09:50:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651415; cv=none; b=UUE1gDIFD4NJXAuxliPPmCE016hm5iMCEqG4kMch25ytKkSNBg/KJlEP/9maeM21GJzrOIvKwoptWjmhJza7inTmKkObrgd7IMXQzlsHmaEqyltQb0rpqd8CZais/jJIGXWQGEKO8z6bINIsuUQknofKoQ6sE4FHjTzEsmrzOrs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651415; c=relaxed/simple; bh=SI27lQ6ouPyc6VSvj6mijRBvLjbpSdfHHV2X5cxHAlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=MmXVwE2ZEf6NIfcKN3BJ2g+obLp+jzebcKXVT4oSFTrcvJF/Pj0XvJ/q9moCb/nbmH5asdB+13ke0LQqoxJcerd/T/cT0c4P4GSbmSMCnnpg0WP6aCRp3FLHsRJF7BOMqpe1aqTpDmSpVSvKa2DfNG5SfDaFP5jM56A7j86T+UA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=qJwWDtA8; arc=none smtp.client-ip=209.85.208.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="qJwWDtA8" Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-2ffa8df8850so36930131fa.3 for ; Sun, 08 Dec 2024 01:50:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651412; x=1734256212; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=qJwWDtA8HYNQUxBJnk5UQAwTob5KH7pl9B6Ae1iyRzoO/77/FJsXTu9ch/SrstK+wl YL1AEeug/zISOaQddiI2/m0qDpX+tiAo7chTJRhzLKKx0LYBIbTIexPJELJ5onZ6aOnk GTYW3mu4Dwnz73cDbodVXNHQaQYh5Zvw3gOZCnnsVmqeJw1D5yAj/g2p8sUPcX0C1l8c GgW8bQx2xYQqT/6ix2CLR8nAvNYrQw7TvihpnwEkdKRAefcK5Z4ohY5kbgXRSs5Mrs80 bdN39B/e2cCwhUGOjb1I9w5ZuJVNMsttzqIe7Dh7qJkZDIRWOfLvNvj9gRPwGcmCaJOr XiYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651412; x=1734256212; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=u9wVOjn6GzTW2k91Nqi/ZuHh2h2KOAwtKLLbjqFCUFtpm9Ylp7CzJLsUFRKQuojw0l Ct/AZ2KZz9Cui0eASyY8UhgmV+mad80eyadvXj+VBQEoRl4PDvVU1gbon99akpnMhan/ hx2sLWU/7QgV16Lu528QlufvddAafr1b3jxG4PSXyO3Abv2aMj843wc30OfxIxH0moTy 7LcA3tIjn8idts6mUBdtIuInXxCbSloQ+a4oTDd2iCg4o/3NcKwojCIiCI0HsJyMN4m7 iD7A8jjj+gg/afWgJrLP0QNutrIq/oZ6sUntz2xunl0GkHybUdVkuH9oCKU1x8pVcDjP WNOQ== X-Gm-Message-State: AOJu0Yz5GzsF2zffJ07MEQuSzt13G6ArAaotgKTg7hhZOjgOJZoSf6TL KJVXc/j4ZSMVNiFZMWyblyuzLrjo0YsyMPev8AsO0ENtRtlMkVR55Z2rkVzZbgk= X-Gm-Gg: ASbGncvqhgCYMV+kY26npDKDeGnxigbEHNY5j/xnQBjNGAZIS1KyyqFasKIpudAqvdv 6ZxgQLgNmTJQ3NfLtPRi1eIzXLrqbNhA/mAdfh2qdBOCgZ0036cluv/iYsbpzoZFM6QncFVD08y bsAnsBhEA9VjfErxjJam43lp6/ykIGpwnxp41YJdQ97GhySXrBNHRvKCADKI80766q+HGKxp+EU qHLtwZbTVfyd3cOzlRQRgSPdk9tTiTwslTLm993x486ytLqrrLZfNNoEorDkKGR X-Google-Smtp-Source: AGHT+IGmOlhACGEiwReXdOmA2tPXqwQWewjxb6Ay7meV1g237ucqsf808iRNKjO6hZpq9iuPGcdG5g== X-Received: by 2002:a05:651c:1586:b0:300:3e66:5881 with SMTP id 38308e7fff4ca-3003e6658cfmr17033281fa.7.1733651411640; Sun, 08 Dec 2024 01:50:11 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:11 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 1/4] net: renesas: rswitch: fix possible early skb release Date: Sun, 8 Dec 2024 14:50:01 +0500 Message-Id: <20241208095004.69468-2-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index b80aa27a7214..32b32aa7e01f 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1681,8 +1681,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; - gq->skbs[gq->cur] = skb; - gq->unmap_addrs[gq->cur] = dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardware completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { From patchwork Sun Dec 8 09:50:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898522 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lf1-f44.google.com (mail-lf1-f44.google.com [209.85.167.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2ECA51448E0 for ; Sun, 8 Dec 2024 09:50:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651416; cv=none; b=AILn538bURoNybCH51Lth2L8/1eRtuBGQW+HWGl+K1E5v/ch2pPqEeTAIOx+8kEOoTOa1IFvQPiLRNY0Tcr455K51DxTZ5vwAKjyfw0DPgSTty2Ms4pLBZ0qdQillFj9YO7YENPuVUWng/R5hDpODqlViBtN8WpcYRTjq7C5JDA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651416; c=relaxed/simple; bh=wXdUfPDZdTp7uaCmZH8pm7BfzwNL7Ba4+AgLadvA+oE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=hMit8s9mnVp4tSOO2xB6gcqrP35YQXbLjbY3+BAg4+am5jmkuuzehHvc7C2HS2/h4Skyi/0Eco+axJgJmRFSm1r0N0Xo9I2tMSVTKsveeCeD4ziXWrrC7lMzZw08wxeKlZRHzh8NjccJa+NE8uqm1u/ZWFoii5q0J5WaTHeYLmc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=VOyNYOcq; arc=none smtp.client-ip=209.85.167.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="VOyNYOcq" Received: by mail-lf1-f44.google.com with SMTP id 2adb3069b0e04-53ffaaeeb76so631332e87.0 for ; Sun, 08 Dec 2024 01:50:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651413; x=1734256213; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=VOyNYOcqXtcI3aCNYRedaRVcOaFPSgTgnsDW1JqQD3s/C/3NnzJwJVPCd1TkgATPzf nt4UwqQWzNDhbwqL3TWfYdICpAb/b2LY+DRvtVlNMAHcaqIjDhwVpc7j/tbuc4czCv7U Ju0b31JTSxN7K0l5o/5yspnzzyTYRfYouZLvaKDTAEqJZQyvhtcUJd/Cyq2Jwr7w7JdZ K16SFeY0qMdvJ0LH/WDSbPaZZIzp7svCNisKyU1yOm0oCWdyHMX4wLR8FQSDCusp3hHe v6pqZ0kbObYDI3a483+JP6zgGJo/DbQ7ztkoD7CrKDTTBsccasIyC554v85uBUGeQzGe /8sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651413; x=1734256213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=AfjH6HODs5JkzutjImJv/CnrqbtnH5PRtNt1SMdOWcjX3PmxQGbna007yC8jg/ZLM6 64IAcDzZ72rcLpgNUDOg55qmTPaHozVVT4YdQOyMGJlS/ecVpEB3A86tYRBegLePQW5o Q/SPGsKYsA61jnO3ed1zVKhzvZx4UhSd8xskCK/6NCDhEhfwuGW5CE9yM0bLgh+pTbAb SUA7E8PooaFmvwJkLjIbPTx+6pA1zvaZlwYQZ5sb4XFbIDceZz3g7DnRr7r6YPjUu3li I7Jc4Tmh5klPFcmTwmubU4qNB+jePIPB4H+4it1F8Mb/BJOTWk8cOdz42rZM2ATHn0Lz 7L6A== X-Gm-Message-State: AOJu0YwRp7GLmIvJUfUw5QNy96ikDfRyvih3cYZeBY9sbYISkOBl0D4+ 2v0gOdYhWm94HPXY6Tg/TkDgvAAABxx1WRWlQ4luut8ogQ9mnoMbQ5KTVezxGS0= X-Gm-Gg: ASbGncvbxgFrsuS64ui3NdhbeISS4W4/5FqNVFQjgX3wV7VxNlACtXHn8qs5QtQMFzg rHZRHVPEfIa79ZWw0H2ICq/xrbpqclNte/plLpwG/sddDtXnjaBLE9umG2/2QultJM0K+auZytR sYlK+kWNzSs7y3fiCHvoMGS0nzbr8RCYdRmilM4WCUAMSp6mJ8nYYhhAdEXX+NOmK+0H3LiUM+n JSAxSY3+lH322RAWwIAHMDRcjO6UfTOOkmrO9YNbdrrp4zenxex013Cajuf+MBG X-Google-Smtp-Source: AGHT+IHjfkWlUO9ktjjTWDVzSSef25MV2HxBTpd82UrqbQLyW1H2AFrdbCeLYV2NDHOM5jBn6C1seA== X-Received: by 2002:a2e:bccb:0:b0:2ff:55f0:ae4b with SMTP id 38308e7fff4ca-3002fc2585amr46517131fa.21.1733651413281; Sun, 08 Dec 2024 01:50:13 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:13 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sun, 8 Dec 2024 14:50:02 +0500 Message-Id: <20241208095004.69468-3-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 32b32aa7e01f..c251becef6f8 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty = rswitch_next_queue_index(gq, false, 1)) { - desc = &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) != DT_FEMPTY) - break; - + desc = &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) == DT_FEMPTY) { dma_rmb(); + skb = gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] = NULL; } + desc->desc.die_dt = DT_EEMPTY; + gq->dirty = rswitch_next_queue_index(gq, false, 1); + desc = &gq->tx_ring[gq->dirty]; } } @@ -1685,6 +1685,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; + dma_wmb(); + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { desc = &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1697,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd goto err_unmap; } - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur = rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); From patchwork Sun Dec 8 09:50:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898523 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C136F147C86 for ; Sun, 8 Dec 2024 09:50:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651418; cv=none; b=qqf+mGr13qy/i6OKWF/5ilPD25vBoBcC5q6eglHLd2C+MMMDj2vFNMPaTB5WuxgUeMtg27xKaQpmMjdKcjaqHgg6/gVFe11BJEXLkp/vSobZfV3Lc00Y9Fp1u2VQ4o2NvUbOI5JdC9rrtzDndmgVxE/A8gZXseTHV8xXXh+PHHg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651418; c=relaxed/simple; bh=K2M2L/ZAYcnrWJuH8IzCe8Rtu47EQV2npWezrC5CH+Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PN3NqcyUynjEsidC8dqIVeqoeftd8V4rzMvaLVSZWNWW4DC9ANIeLqX6p9dTzO/UW4HT2otdW0QENUgoba5xgM2uRfLrHV5EDsRMDlvoyCah9cW8Xw0xWZDz3YCX1S6TFpddxO5hnw6bdhUtQJsOwdn24IhtBF/enXaSLWcZBmE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=sPCwhCBd; arc=none smtp.client-ip=209.85.208.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="sPCwhCBd" Received: by mail-lj1-f179.google.com with SMTP id 38308e7fff4ca-30034ad2ca3so13070801fa.1 for ; Sun, 08 Dec 2024 01:50:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651415; x=1734256215; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=UJZ/cFgyayhBFYtEHeJoPJb1EWnv+22CKraiiow1EcU=; b=sPCwhCBdc6YMouvWYQ8hlPL3wknNBTqsfqp9NwAgaK4KIJ1VwbGcdu4fBlrTxG4z/z fGcVGMYcjb5364NRPfSkbz5+NGH2dMugSZ+Wctq0DV6IEZnH9zZD4ke5b6YllYRVUXuh ErUqENNfOBpO7MuuLuUMVE9Js0gVdeDL5xd05lnxsrhneTCzWFHo6to+ah6NjlT0f2f1 L5uzKOaA0qc5g5uB0yU1lUG4dnIEY9SOBj1G4lZdL6z4VWaGpuFL4vwchdcNPlMnyLsP jLUJg2TyiR2ByUOgq8wczKAqPzjtXhwJc/xXrbrb7eYm1Ab0bTM6vT3b6YSQR2BGgAUh LFTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651415; x=1734256215; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UJZ/cFgyayhBFYtEHeJoPJb1EWnv+22CKraiiow1EcU=; b=IDEZyt/It3+E784C5Zm32ATOpldh1eKvZ8WCqsUAraiDW7DmcdgYtoAPLnNyMO0B3k A/nyeJ1VrvxiG02C4zSOUbgBbQcWJJm6zzAuxKnKdJpQBiQxiGh3Z5XrZJw/f4Qvuelc ysVj3Uzv02ni0689ZcmgXUyZ9G0y+tYt5s/H1eRNZ01wvi3s0kp4h3VIreSffqbh2sQr LJpS+LQcwSWo246+LmLm66ONYgFpf33wjOxa+zfNU++QArdh/S77++OH1eNSWVBF7Fft 33ZDmOEpjAKhElbdlIQrxBR8/PX3lClsMb7eP0swgq9g0fzWl6BDhdcxAHKCXuhvMHcQ RnGA== X-Gm-Message-State: AOJu0Yz8Blf2WVyTffWhGC3AVvIiQjWWSqufQ0DzEimsUK09Ly693uhC Wy6ZO29Km00a0ErMuot6VK24C1pQgucTWN+rg7lzWBjlc03WpomoZ2sbqAY5cCM= X-Gm-Gg: ASbGncuCoe1WJ1yLLD5CXrgnIuzM2xZgods42JOUi+Fd93OQzBETk0PtHXeC4R6D8Wv DcYb6mhyrBtsXEvtBkl2Cj+xbfZIGiAx701acIS6544odDey/vfHBpzlP7dCfpJ6f7zPoYngqYr eYtFMjJH7uKzQSKRASrIx6+WqKE8Q8T/ovBGMmS1dQc3CTS3xwKPJbjKxkkpoAaVeTeQwfXhuti vmtW88JNDtDqi619qKbbEEGvi2+71OsiSuIMAQCl1PB9KkzZueI95S8xbCSXJGi X-Google-Smtp-Source: AGHT+IEg2JUCxfsh/bJ+hiKC7kKcxPI03So5n7bJFcOp4QMs6n7AD95qHIYMZq9Fveaz33U6ohLDAg== X-Received: by 2002:a2e:b88e:0:b0:302:1d24:8db9 with SMTP id 38308e7fff4ca-3021d249048mr4578011fa.20.1733651414953; Sun, 08 Dec 2024 01:50:14 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:14 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 3/4] net: renesas: rswitch: fix leaked pointer on error path Date: Sun, 8 Dec 2024 14:50:03 +0500 Message-Id: <20241208095004.69468-4-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org If error path is taken while filling descriptor for a frame, skb pointer is left in the entry. Later, on the ring entry reuse, the same entry could be used as a part of a multi-descriptor frame, and skb for that new frame could be stored in a different entry. Then, the stale pointer will reach the completion routine, and passed to the release operation. Fix that by clearing the saved skb pointer at the error path. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index c251becef6f8..af0bc95ad6ae 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1703,6 +1703,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd return ret; err_unmap: + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = NULL; dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE); err_kfree: From patchwork Sun Dec 8 09:50:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898524 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7456814A0A4 for ; Sun, 8 Dec 2024 09:50:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651421; cv=none; b=unqeHC3AXySPAANoWWZPykwo2/plaKMAy8+8UM/7NfZcOnb2LVxsqJ4j4hyWYiGnE0KzWuYJBOi9u0yhITxE6Wpz5Bt9e1ksEOx5jzAClSLb+z7e4HkJkITYNVbd91hI0niLEYuEuG1XzkHDLsKFqypeqjyYI5eCrWUNWfbnxDs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651421; c=relaxed/simple; bh=m3xLhEgvkVumCBPK7rvot6sHsRzw5hUEzzHNk/EM1Jw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=cBtJWmTa9pl0JOOz1pMpMPK3BqheUPvqYHXRcbX2PWgK1rblLJxjYrLRiRtRldgBGkugiga9X88YUMiqrgYY4Px37CGRS5+/XM1crTQa4Z6EfBeouRKosQhwvjjsdCDEGVV3RbRVmWTogDo5GBQFSMNDpsKniAxLASm4E1qrYzY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=EnLovTV1; arc=none smtp.client-ip=209.85.208.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="EnLovTV1" Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-30219437e63so4465241fa.1 for ; Sun, 08 Dec 2024 01:50:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651417; x=1734256217; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qi9ee4q7wG9Z60y8ibg5HDfGF5CuB96sJUYWCS5oeVQ=; b=EnLovTV1hVXNz3iGbnvlrJwcGiUA+4QEgF7a76lEXrH0MowfFGGmST3lT+Vg9EZEOI M1AdhvjdWrGkXFqF6XebsOe2aU5z1oYHI8PSVanWWqGRXiSbET4iKKLOehkkytNN86QX cz3lC87U3WqQDd+aMkjr4EUW39ddEYS2EPt79n9xdRkSBCcsxmvNrEjosq6uyv2nMan4 j1CwFmcwBvOyK9oU3If5pwoLQKjofhhFWjTJXpGt12v9dKBRh245PaLq4uyCDRADzJtm Dmb+cWLBHAMkGd+eJNRyW/pO1KUagLh3vtJFjS0S30UXIACZqSE/GgG5s0TpCdvM4jSz elXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651417; x=1734256217; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qi9ee4q7wG9Z60y8ibg5HDfGF5CuB96sJUYWCS5oeVQ=; b=C4zwLDyAWlv+Jr5bsG4WDmmdKjmlPcEMKLzIozPfdldzFm7/4sQA4LmWv3lPBYPsBI 1KGkvxCKSL9s0+s3FQjVHuiLAgSUM9wTyl3bUX3owmxVJwiP+ahqOPLYr/m7p4QwOrCY QtSSEoJHv8dUM35vR2gj1mJu7uSq4NYjIH2QVgnbbP9zUlsCH4lTbr+zak8IQrsJyulk VQ2CpOqksATmTzwoZ+2MfqHoGHOZ3E+95liaX9W1XXmkFKY5uNnvNHFO6ahS2TvDertV m2hFjQHPNvkn6Hov1/DKbzotgQDq30xBNB2i+c15VNs9ZJmfK9Ugqe7UbWVDtaOn4sOs nS+A== X-Gm-Message-State: AOJu0YwdsOIryvuhu50ls89I8SeUJtziez3aBaUp3vRgjkJoAR9tv9FE CGrNXy34lT9ip3mfx4ADahxMS/1noHd8v5TsZNJcAOT/4KdMOEHflm0nB86KjnM= X-Gm-Gg: ASbGncsC1z/TZxUB9THOlxfNNOhA+M+SOgVEtj0/nbQJqASHvfRNpVEbm9Bh1ThzSpl BvpXlrSKMPC5to6/DJuTUxQ9gIYlLBc08jGfDFhmE8u20rjGgHqlar00ZT+HItycGwnPjG5HUbb rPfuMH+M96c1aoQm1dANFq9I6HT1lP71ucMH8zBy0b0ojznEVEliojRNw6a/dxTjcexPIHAkhhu cMFG1AnYr+smgOUFRdJ2jV3ww4tofDrNwNHmrn1suCc7LI3MrItfo1pHXYR34t8 X-Google-Smtp-Source: AGHT+IGMZmYJjHnUsc238RV3yY9xHt3nqaPN8mYEXiS21C8jUq0UJbg1npLyXNDZJfghXQMbM8fRmg== X-Received: by 2002:a2e:a10e:0:b0:300:11e4:ce2d with SMTP id 38308e7fff4ca-3002deff095mr31481261fa.20.1733651416628; Sun, 08 Dec 2024 01:50:16 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:16 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 4/4] net: renesas: rswitch: avoid use-after-put for a device tree node Date: Sun, 8 Dec 2024 14:50:04 +0500 Message-Id: <20241208095004.69468-5-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index af0bc95ad6ae..3b57abada200 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1891,7 +1891,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1921,6 +1920,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1934,6 +1934,7 @@ static void rswitch_device_free(struct rswitch_private *priv, unsigned int index rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); }