| Message ID | 20241101025316.3234023-1-ruanjinjie@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3b557be89fc688dbd9ccf704a70f7600a094f13a |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v3] net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() | expand |
On Fri, 1 Nov 2024, Jinjie Ruan wrote: > The error path in t7xx_dpmaif_rx_buf_alloc(), free and unmap the already > allocated and mapped skb in a loop, but the loop condition terminates when > the index reaches zero, which fails to free the first allocated skb at > index zero. > > Check with i-- so that skb at index 0 is freed as well. > > Cc: stable@vger.kernel.org > Fixes: d642b012df70 ("net: wwan: t7xx: Add data path interface") > Acked-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> > Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> > --- > v3: > - Remove suggested-by. > - Use i-- to simplify the fix. > - Add Acked-by. > - Add cc stable. > - Update the commit message. > v2: > - Update the commit title. > - Declare i as signed to avoid the endless loop. > --- > drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c > index 210d84c67ef9..7a9c09cd4fdc 100644 > --- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c > +++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c > @@ -226,7 +226,7 @@ int t7xx_dpmaif_rx_buf_alloc(struct dpmaif_ctrl *dpmaif_ctrl, > return 0; > > err_unmap_skbs: > - while (--i > 0) > + while (i--) > t7xx_unmap_bat_skb(dpmaif_ctrl->dev, bat_req->bat_skb, i); > > return ret; > Thanks. Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
…
> Check with i-- so that skb at index 0 is freed as well.
…
Is the same source code adjustment needed also for the implementation
of the function “t7xx_dpmaif_rx_frag_alloc”?
https://elixir.bootlin.com/linux/v6.12-rc5/source/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c#L384
Regards,
Markus
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Fri, 1 Nov 2024 10:53:16 +0800 you wrote: > The error path in t7xx_dpmaif_rx_buf_alloc(), free and unmap the already > allocated and mapped skb in a loop, but the loop condition terminates when > the index reaches zero, which fails to free the first allocated skb at > index zero. > > Check with i-- so that skb at index 0 is freed as well. > > [...] Here is the summary with links: - [net,v3] net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() https://git.kernel.org/netdev/net/c/3b557be89fc6 You are awesome, thank you!
diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c index 210d84c67ef9..7a9c09cd4fdc 100644 --- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c +++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c @@ -226,7 +226,7 @@ int t7xx_dpmaif_rx_buf_alloc(struct dpmaif_ctrl *dpmaif_ctrl, return 0; err_unmap_skbs: - while (--i > 0) + while (i--) t7xx_unmap_bat_skb(dpmaif_ctrl->dev, bat_req->bat_skb, i); return ret;
The error path in t7xx_dpmaif_rx_buf_alloc(), free and unmap the already allocated and mapped skb in a loop, but the loop condition terminates when the index reaches zero, which fails to free the first allocated skb at index zero. Check with i-- so that skb at index 0 is freed as well. Cc: stable@vger.kernel.org Fixes: d642b012df70 ("net: wwan: t7xx: Add data path interface") Acked-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> --- v3: - Remove suggested-by. - Use i-- to simplify the fix. - Add Acked-by. - Add cc stable. - Update the commit message. v2: - Update the commit title. - Declare i as signed to avoid the endless loop. --- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)