| Message ID | 20240113042221.480650-1-nikita.yoush@cogentembedded.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | e327b2372bc0f18c30433ac40be07741b59231c5 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: ravb: Fix dma_addr_t truncation in error case | expand |
Hello Nikita, Thanks for your patch. On 2024-01-13 10:22:21 +0600, Nikita Yushchenko wrote: > In ravb_start_xmit(), ravb driver uses u32 variable to store result of > dma_map_single() call. Since ravb hardware has 32-bit address fields in > descriptors, this works properly when mapping is successful - it is > platform's job to provide mapping addresses that fit into hardware > limitations. > > However, in failure case dma_map_single() returns DMA_MAPPING_ERROR > constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant > in u32 leads to truncation, and further call to dma_mapping_error() > fails to notice the error. > > Fix that by storing result of dma_map_single() in a dma_addr_t > variable. > > Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") > Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> > --- > drivers/net/ethernet/renesas/ravb_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c > index 8649b3e90edb..0e3731f50fc2 100644 > --- a/drivers/net/ethernet/renesas/ravb_main.c > +++ b/drivers/net/ethernet/renesas/ravb_main.c > @@ -1949,7 +1949,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) > struct ravb_tstamp_skb *ts_skb; > struct ravb_tx_desc *desc; > unsigned long flags; > - u32 dma_addr; > + dma_addr_t dma_addr; > void *buffer; > u32 entry; > u32 len; > -- > 2.39.2 > >
On 1/13/24 7:22 AM, Nikita Yushchenko wrote: > In ravb_start_xmit(), ravb driver uses u32 variable to store result of > dma_map_single() call. Since ravb hardware has 32-bit address fields in > descriptors, this works properly when mapping is successful - it is > platform's job to provide mapping addresses that fit into hardware > limitations. > > However, in failure case dma_map_single() returns DMA_MAPPING_ERROR > constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant > in u32 leads to truncation, and further call to dma_mapping_error() > fails to notice the error. > > Fix that by storing result of dma_map_single() in a dma_addr_t > variable. > > Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") > Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com> Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru> [...] MBR, Sergey
On 1/12/2024 8:22 PM, Nikita Yushchenko wrote: > In ravb_start_xmit(), ravb driver uses u32 variable to store result of > dma_map_single() call. Since ravb hardware has 32-bit address fields in > descriptors, this works properly when mapping is successful - it is > platform's job to provide mapping addresses that fit into hardware > limitations. > > However, in failure case dma_map_single() returns DMA_MAPPING_ERROR > constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant > in u32 leads to truncation, and further call to dma_mapping_error() > fails to notice the error. > > Fix that by storing result of dma_map_single() in a dma_addr_t > variable. > > Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") > Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Nit: since this is a bug fix you should prefix your patches with "[PATCH net]", see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/maintainer-netdev.rst#n62
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Sat, 13 Jan 2024 10:22:21 +0600 you wrote: > In ravb_start_xmit(), ravb driver uses u32 variable to store result of > dma_map_single() call. Since ravb hardware has 32-bit address fields in > descriptors, this works properly when mapping is successful - it is > platform's job to provide mapping addresses that fit into hardware > limitations. > > However, in failure case dma_map_single() returns DMA_MAPPING_ERROR > constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant > in u32 leads to truncation, and further call to dma_mapping_error() > fails to notice the error. > > [...] Here is the summary with links: - net: ravb: Fix dma_addr_t truncation in error case https://git.kernel.org/netdev/net/c/e327b2372bc0 You are awesome, thank you!
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index 8649b3e90edb..0e3731f50fc2 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -1949,7 +1949,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) struct ravb_tstamp_skb *ts_skb; struct ravb_tx_desc *desc; unsigned long flags; - u32 dma_addr; + dma_addr_t dma_addr; void *buffer; u32 entry; u32 len;
In ravb_start_xmit(), ravb driver uses u32 variable to store result of dma_map_single() call. Since ravb hardware has 32-bit address fields in descriptors, this works properly when mapping is successful - it is platform's job to provide mapping addresses that fit into hardware limitations. However, in failure case dma_map_single() returns DMA_MAPPING_ERROR constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant in u32 leads to truncation, and further call to dma_mapping_error() fails to notice the error. Fix that by storing result of dma_map_single() in a dma_addr_t variable. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com> --- drivers/net/ethernet/renesas/ravb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)