| Message ID | 574049c5-70a0-4dd3-85c3-40e396d00b2f@gmail.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] r8169: Fix possible ring buffer corruption on fragmented Tx packets | expand |
On 21.05.2024 23:20, Ken Milmore wrote: > An issue was found on the RTL8125b when transmitting small fragmented > packets, whereby invalid entries were inserted into the transmit ring > buffer, subsequently leading to calls to dma_unmap_single() with a null > address. > > This was caused by rtl8169_start_xmit() not noticing changes to nr_frags > which may occur when small packets are padded (to work around hardware > quirks) in rtl8169_tso_csum_v2(). > > To fix this, postpone inspecting nr_frags until after any padding has been > applied. > > Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit") Meanwhile also netdev fixes should have the following: CC: stable@vger.kernel.org See https://www.kernel.org/doc/Documentation/process/stable-kernel-rules.rst > Signed-off-by: Ken Milmore <ken.milmore@gmail.com> > --- > drivers/net/ethernet/realtek/r8169_main.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c > index 86a6d4225bc..86ed9189d5f 100644 > --- a/drivers/net/ethernet/realtek/r8169_main.c > +++ b/drivers/net/ethernet/realtek/r8169_main.c > @@ -4337,12 +4337,12 @@ static void rtl8169_doorbell(struct rtl8169_private *tp) > static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, > struct net_device *dev) > { > - unsigned int frags = skb_shinfo(skb)->nr_frags; > struct rtl8169_private *tp = netdev_priv(dev); > unsigned int entry = tp->cur_tx % NUM_TX_DESC; > struct TxDesc *txd_first, *txd_last; > bool stop_queue, door_bell; > u32 opts[2]; > + unsigned int frags; > netdev wants reverse xmas tree. > if (unlikely(!rtl_tx_slots_avail(tp))) { > if (net_ratelimit()) > @@ -4364,6 +4364,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, > > txd_first = tp->TxDescArray + entry; > > + frags = skb_shinfo(skb)->nr_frags; > if (frags) { > if (rtl8169_xmit_frags(tp, skb, opts, entry)) > goto err_dma_1; Run get_maintainers.pl. The netdev subsystem maintainers are missing. Apart from that lgtm.
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index 86a6d4225bc..86ed9189d5f 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -4337,12 +4337,12 @@ static void rtl8169_doorbell(struct rtl8169_private *tp) static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, struct net_device *dev) { - unsigned int frags = skb_shinfo(skb)->nr_frags; struct rtl8169_private *tp = netdev_priv(dev); unsigned int entry = tp->cur_tx % NUM_TX_DESC; struct TxDesc *txd_first, *txd_last; bool stop_queue, door_bell; u32 opts[2]; + unsigned int frags; if (unlikely(!rtl_tx_slots_avail(tp))) { if (net_ratelimit()) @@ -4364,6 +4364,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, txd_first = tp->TxDescArray + entry; + frags = skb_shinfo(skb)->nr_frags; if (frags) { if (rtl8169_xmit_frags(tp, skb, opts, entry)) goto err_dma_1;
An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into the transmit ring buffer, subsequently leading to calls to dma_unmap_single() with a null address. This was caused by rtl8169_start_xmit() not noticing changes to nr_frags which may occur when small packets are padded (to work around hardware quirks) in rtl8169_tso_csum_v2(). To fix this, postpone inspecting nr_frags until after any padding has been applied. Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit") Signed-off-by: Ken Milmore <ken.milmore@gmail.com> --- drivers/net/ethernet/realtek/r8169_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)