From patchwork Tue Jul 27 08:21:46 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 12402119 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99874C43216 for ; Tue, 27 Jul 2021 08:22:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7883061042 for ; Tue, 27 Jul 2021 08:22:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235955AbhG0IWB (ORCPT ); Tue, 27 Jul 2021 04:22:01 -0400 Received: from relmlor2.renesas.com ([210.160.252.172]:15065 "EHLO relmlie6.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S235629AbhG0IV7 (ORCPT ); Tue, 27 Jul 2021 04:21:59 -0400 X-IronPort-AV: E=Sophos;i="5.84,272,1620658800"; d="scan'208";a="88851480" Received: from unknown (HELO relmlir5.idc.renesas.com) ([10.200.68.151]) by relmlie6.idc.renesas.com with ESMTP; 27 Jul 2021 17:21:59 +0900 Received: from localhost.localdomain (unknown [10.166.14.185]) by relmlir5.idc.renesas.com (Postfix) with ESMTP id 44F30400F7B9; Tue, 27 Jul 2021 17:21:59 +0900 (JST) From: Yoshihiro Shimoda To: sergei.shtylyov@gmail.com, davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, Yoshihiro Shimoda Subject: [PATCH 1/2] ravb: Fix descriptor counters' conditions Date: Tue, 27 Jul 2021 17:21:46 +0900 Message-Id: <20210727082147.270734-2-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210727082147.270734-1-yoshihiro.shimoda.uh@renesas.com> References: <20210727082147.270734-1-yoshihiro.shimoda.uh@renesas.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org The descriptor counters ({cur,dirty}_[rt]x) acts as free counters so that conditions are possible to be incorrect when a left value was overflowed. So, for example, ravb_tx_free() could not free any descriptors because the following condition was checked as a signed value, and then "NETDEV WATCHDOG" happened: for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) { To fix the issue, add get_num_desc() to calculate numbers of remaining descriptors. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Yoshihiro Shimoda --- drivers/net/ethernet/renesas/ravb_main.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index 805397088850..70fbac572036 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -172,6 +172,14 @@ static const struct mdiobb_ops bb_ops = { .get_mdio_data = ravb_get_mdio_data, }; +static u32 get_num_desc(u32 from, u32 subtract) +{ + if (from >= subtract) + return from - subtract; + + return U32_MAX - subtract + 1 + from; +} + /* Free TX skb function for AVB-IP */ static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only) { @@ -183,7 +191,7 @@ static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only) int entry; u32 size; - for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) { + for (; get_num_desc(priv->cur_tx[q], priv->dirty_tx[q]) > 0; priv->dirty_tx[q]++) { bool txed; entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] * @@ -536,8 +544,8 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q) { struct ravb_private *priv = netdev_priv(ndev); int entry = priv->cur_rx[q] % priv->num_rx_ring[q]; - int boguscnt = (priv->dirty_rx[q] + priv->num_rx_ring[q]) - - priv->cur_rx[q]; + int boguscnt = get_num_desc(priv->dirty_rx[q], priv->cur_rx[q]) + + priv->num_rx_ring[q]; struct net_device_stats *stats = &priv->stats[q]; struct ravb_ex_rx_desc *desc; struct sk_buff *skb; @@ -613,7 +621,7 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q) } /* Refill the RX ring buffers. */ - for (; priv->cur_rx[q] - priv->dirty_rx[q] > 0; priv->dirty_rx[q]++) { + for (; get_num_desc(priv->cur_rx[q], priv->dirty_rx[q]) > 0; priv->dirty_rx[q]++) { entry = priv->dirty_rx[q] % priv->num_rx_ring[q]; desc = &priv->rx_ring[q][entry]; desc->ds_cc = cpu_to_le16(RX_BUF_SZ); @@ -1499,8 +1507,8 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) u32 len; spin_lock_irqsave(&priv->lock, flags); - if (priv->cur_tx[q] - priv->dirty_tx[q] > (priv->num_tx_ring[q] - 1) * - num_tx_desc) { + if (get_num_desc(priv->cur_tx[q], priv->dirty_tx[q]) > + (priv->num_tx_ring[q] - 1) * num_tx_desc) { netif_err(priv, tx_queued, ndev, "still transmitting with the full ring!\n"); netif_stop_subqueue(ndev, q); @@ -1598,7 +1606,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) ravb_modify(ndev, TCCR, TCCR_TSRQ0 << q, TCCR_TSRQ0 << q); priv->cur_tx[q] += num_tx_desc; - if (priv->cur_tx[q] - priv->dirty_tx[q] > + if (get_num_desc(priv->cur_tx[q], priv->dirty_tx[q]) > (priv->num_tx_ring[q] - 1) * num_tx_desc && !ravb_tx_free(ndev, q, true)) netif_stop_subqueue(ndev, q); From patchwork Tue Jul 27 08:21:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 12402121 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A12C2C4338F for ; Tue, 27 Jul 2021 08:22:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8464D60F58 for ; Tue, 27 Jul 2021 08:22:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235963AbhG0IWD (ORCPT ); Tue, 27 Jul 2021 04:22:03 -0400 Received: from relmlor1.renesas.com ([210.160.252.171]:5647 "EHLO relmlie5.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S235906AbhG0IWA (ORCPT ); Tue, 27 Jul 2021 04:22:00 -0400 X-IronPort-AV: E=Sophos;i="5.84,272,1620658800"; d="scan'208";a="88892218" Received: from unknown (HELO relmlir5.idc.renesas.com) ([10.200.68.151]) by relmlie5.idc.renesas.com with ESMTP; 27 Jul 2021 17:21:59 +0900 Received: from localhost.localdomain (unknown [10.166.14.185]) by relmlir5.idc.renesas.com (Postfix) with ESMTP id 54ACA400D4FF; Tue, 27 Jul 2021 17:21:59 +0900 (JST) From: Yoshihiro Shimoda To: sergei.shtylyov@gmail.com, davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, Yoshihiro Shimoda Subject: [PATCH 2/2] sh_eth: Fix descriptor counters' conditions Date: Tue, 27 Jul 2021 17:21:47 +0900 Message-Id: <20210727082147.270734-3-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210727082147.270734-1-yoshihiro.shimoda.uh@renesas.com> References: <20210727082147.270734-1-yoshihiro.shimoda.uh@renesas.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org The descriptor counters ({cur,dirty}_[rt]x) acts as free counters so that conditions are possible to be incorrect when a left value was overflowed. So, for example, sh_eth_tx_free() could not free any descriptors because the following condition was checked as a signed value, and then "NETDEV WATCHDOG" happened: for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) { To fix the issue, add get_num_desc() to calculate numbers of remaining descriptors. Fixes: 86a74ff21a7a ("net: sh_eth: add support for Renesas SuperH Ethernet") Signed-off-by: Yoshihiro Shimoda --- drivers/net/ethernet/renesas/sh_eth.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c index 840478692a37..7c9445ad684b 100644 --- a/drivers/net/ethernet/renesas/sh_eth.c +++ b/drivers/net/ethernet/renesas/sh_eth.c @@ -1227,6 +1227,14 @@ static const struct mdiobb_ops bb_ops = { .get_mdio_data = sh_get_mdio, }; +static u32 get_num_desc(u32 from, u32 subtract) +{ + if (from >= subtract) + return from - subtract; + + return U32_MAX - subtract + 1 + from; +} + /* free Tx skb function */ static int sh_eth_tx_free(struct net_device *ndev, bool sent_only) { @@ -1236,7 +1244,7 @@ static int sh_eth_tx_free(struct net_device *ndev, bool sent_only) int entry; bool sent; - for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) { + for (; get_num_desc(mdp->cur_tx, mdp->dirty_tx) > 0; mdp->dirty_tx++) { entry = mdp->dirty_tx % mdp->num_tx_ring; txdesc = &mdp->tx_ring[entry]; sent = !(txdesc->status & cpu_to_le32(TD_TACT)); @@ -1587,7 +1595,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota) struct sh_eth_rxdesc *rxdesc; int entry = mdp->cur_rx % mdp->num_rx_ring; - int boguscnt = (mdp->dirty_rx + mdp->num_rx_ring) - mdp->cur_rx; + int boguscnt = get_num_desc(mdp->dirty_rx, mdp->cur_rx) + mdp->num_rx_ring; int limit; struct sk_buff *skb; u32 desc_status; @@ -1667,7 +1675,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota) } /* Refill the Rx ring buffers. */ - for (; mdp->cur_rx - mdp->dirty_rx > 0; mdp->dirty_rx++) { + for (; get_num_desc(mdp->cur_rx, mdp->dirty_rx) > 0; mdp->dirty_rx++) { entry = mdp->dirty_rx % mdp->num_rx_ring; rxdesc = &mdp->rx_ring[entry]; /* The size of the buffer is 32 byte boundary. */ @@ -2499,7 +2507,7 @@ static netdev_tx_t sh_eth_start_xmit(struct sk_buff *skb, unsigned long flags; spin_lock_irqsave(&mdp->lock, flags); - if ((mdp->cur_tx - mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) { + if (get_num_desc(mdp->cur_tx, mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) { if (!sh_eth_tx_free(ndev, true)) { netif_warn(mdp, tx_queued, ndev, "TxFD exhausted.\n"); netif_stop_queue(ndev);