From patchwork Fri Dec 6 19:00:12 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897580 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFD41198A06 for ; Fri, 6 Dec 2024 19:00:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511647; cv=none; b=Ursxlu4AgNtga2znKmUg4+A9W9GQmrtVvufwMFCWlNMMfAo1K0B7SeBZqJbS4tfH3718jJMDlzpU959KwoCEi+hZST4gjzr7zBTZJriY1bz3j9T3qRDyg/g7mH4s8Wrf8+ULPinV1ah7N2/Ru00WBJMFPqfj6AKDa5vsmIcB5EU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511647; c=relaxed/simple; bh=SI27lQ6ouPyc6VSvj6mijRBvLjbpSdfHHV2X5cxHAlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=k6hzoH4bxGV5uQvLDTf2JK9g48knKwfp0nOorOPSTLhqxWQM+jvwTXHUuwO4gImJmFt4P07+k4zrgrdhiMVpTic21PwHPBOIyfN9ahRCvgtDk53ri21E9gB8ZHh7MvYInWM+4iyNi92vTGFz6YGLpEhooogVPOXvJtbInzRaDWs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=An9K38cC; arc=none smtp.client-ip=209.85.208.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="An9K38cC" Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-2ffc7a2c5d5so24244431fa.1 for ; Fri, 06 Dec 2024 11:00:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511643; x=1734116443; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=An9K38cCeebXwLpU8bCqmEJrBomOqrqLyAEbSNfU5B1LcVFGHGcoTePkagOr9EooU+ ztKAPCweLgsy27AP1Rzz64gf2Iy8pl8uUv+1twRJ2O+gKY+a0jYaHQ++Fn/yBikwAtjM vFuwi5irPwKRVd9L+4pAP2HcCv1J5uwFjkwLEXQVvq5bs1T27WiWPfs6AXPLWDEutQLP SJwpsErk307MnFV/g+wN3GtDb4f3G5h/FUHjfj/Wlqx2v9DifPtQGBCbikm7iIJQX1gw fxGRuw1sAsPHw6Tqq4OiLETw+ewIj4h76o1dUXpdTVxZnUjBVCdCQN6A5Sx5z7LLnbAD d4Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511643; x=1734116443; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=jT5VI0Iv/Jq96t78QSsENGEmNhZ7xE/g+ErJYgtjkZp616EogUHFvsi48MEk5vsrkp wx0M9Mtx9XQu62e/uz6n3SRIGqa8RHLrunpzcWyhYcQDPV9vX8edIaeVjyOdOSuFh2C5 MAjjIpAwvHL+lD5kgjRpyTGELDGB1Ib962G3dyl3IZz4PLgql8QOypbm5Ruj2EDfQkyi bTB7eO7/DFtOSeLp/lbEG8UFNIN7OsbKVQArcr6QeGL4Nks2KwRfuThOe7SStp3Y67Z1 YtnKS6RYe/61+sWiWcMQllArbGpXHbN4DMUvmm4bVPw1f5Bhxi74AxhIXZBqx0+L8KbM yGkg== X-Forwarded-Encrypted: i=1; AJvYcCVgNhgDPqWOIehIhcIm63TKAuGmaFEhbdwKm6S6/1PRiWWpL+qqxeuRTXaHEIAeG8kh8InvRZ2gyArBB+PdYfUoQQ==@vger.kernel.org X-Gm-Message-State: AOJu0Yyv/Wyo31Fmb2DZoxfJUaRJSZME9AI7R4Ak74YiBToXCBSAu+tB Xrn8RSSBcSF9w5SWIucoSABAMAwvdlLPxpkeqGF+nRHV9iZcVgVEovfYmq3GX6c= X-Gm-Gg: ASbGncspBv2PSHJVjeME8zF8m1ZVXrOHh2TT2VcElA8uGD7+vja0Rb88EC85tsLBphX z8D3cFnXMNZ6sHVtpdnL5o6MWUqaEmOd1zCPLGVYg8o/jCUggSrfy/3Xrszao3BSgcbwHAd26qJ EldFMLLTHstOey2tgDa8Ri2CASNX8PN5/fs3UjnSH6obp9zXUcNi1rExDhw8AhKaZfeVlYnj++0 lZpZgX50aUm5fwK5epcy59V6c0F7YaDE+pbiH1NLUWt7S6Kp0ibDYeeXgR/+9Cc X-Google-Smtp-Source: AGHT+IEW2UU+jTNoTOcEYuuCfhMKM2BI21VZcY54iVxmn2QTSlWVK53wH/yWJXy8oWjj5yDpAga4hA== X-Received: by 2002:a2e:a98e:0:b0:2ff:8f5f:1adf with SMTP id 38308e7fff4ca-3002f795a90mr13121781fa.5.1733511643070; Fri, 06 Dec 2024 11:00:43 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:42 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 1/4] net: renesas: rswitch: fix possible early skb release Date: Sat, 7 Dec 2024 00:00:12 +0500 Message-Id: <20241206190015.4194153-2-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index b80aa27a7214..32b32aa7e01f 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1681,8 +1681,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; - gq->skbs[gq->cur] = skb; - gq->unmap_addrs[gq->cur] = dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardware completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { From patchwork Fri Dec 6 19:00:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897581 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f171.google.com (mail-lj1-f171.google.com [209.85.208.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B326A1FFC57 for ; Fri, 6 Dec 2024 19:00:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511648; cv=none; b=oDz+fiED3xOhJBw+xi+226pf1hcLvSwdq5w/VO1Ar+G/4ok5bNaYwjXqt4hfqB9Pg6CrsZn0h3H4AP0z7Q0cdod/xDUotO8TERm7yl3DAsoVLHuTaCCIm8uLzDbY0padtsrVDyGz1KAPVoY4m7OfWgcdQdhWd9q0Veov2+X9OxE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511648; c=relaxed/simple; bh=b5jXhaNolTyyvrbjKKxRcvCAJp8P/hsnV5mqr6x9R1Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Ns1Ei9Qt++upN+uqtdfIuYSyGaKe2niPU/9zHQsgpJeGvO6+rcGpg9mgtyb5AKsv+lbHIag8c2QmbibqNfHM7it98DKq/77iOBxqi+0HDFJZ1AshrgROmffnryrX94TSL0iZy7fGtJouC/8+Ou8IJv8rYJbeSFy3GWzCA7QgwEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=XRyJBV5r; arc=none smtp.client-ip=209.85.208.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="XRyJBV5r" Received: by mail-lj1-f171.google.com with SMTP id 38308e7fff4ca-30036310158so8156381fa.0 for ; Fri, 06 Dec 2024 11:00:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511645; x=1734116445; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=U6OmUl/hmI7+OxMAFAfIf+jIYSG9pd6PU033H69utPY=; b=XRyJBV5r5naGO6NKYhqVdJ1aD41SPwRTObnU+SV6/NfOjJDykNY6Bo+ydj5kUjMuZs 0uT5TX16HjBY34lB7Mu6iV0uVeofnX4zfgowjzPQ7SBgZVr2lStVSRXJS7ZVmgFZnZDX 8ScRIS3kTXBtNiGgDsOid1y3nxeQxzC7+P78iHR68t8lRxhjPJJULAx25mMcPydWDIxl du6U3Q4TCqiHEXhaH5wso9j0WXhptPUIlpfuh3wUUNNC0l/csE3RSdth1ARqF2xW3ZwY eB4k2/unOTf/uRrJuIZg/Uxk+7b4NDtFOvnK3hcYyNmwX5djLN9QgmKk4ls/lnWKWD/D 6rKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511645; x=1734116445; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=U6OmUl/hmI7+OxMAFAfIf+jIYSG9pd6PU033H69utPY=; b=sFxfhQJV7O4ArHAJayu7GEt3malQUePqJQVqYJTIFnGD5EK+KlNxUe8bIg64Nc5vfX 0tD2QkdnYuhZAquxUDZO/ZotjKa5SPILhxdhH8Egt4MfHIUF3fS/3AuDkh5wxHg+R7BC 6lwsbxzemG2o/BXdgrA4jfuKHeOjlypn/0l4FSr6ExefTiCf6J6IbzlwWo8hNJfN7NHA TPzTj+3D/wQwVoQj3gtUf6W/NG88n3MCmjOzZ0j5GW8GqncB2nRN4l50HRziBKdutTTe n85pyo4M6Rj5oLTn8GkIbRgIs3R6mQeK/tj4e5m4pkQS0oh1L30Y/p6YDvOenVB52BpV BliA== X-Forwarded-Encrypted: i=1; AJvYcCVw/1k1gqy8KSwKAEbYSf1RF9UIA3wQX1sj/5nTs2eW7fVTAypUgBt9j0BI4nodoQ2ZPQIgt/ibtD1PEiSOlqM8mg==@vger.kernel.org X-Gm-Message-State: AOJu0YyvpKpwm8jjbuhxuSnvRPgai/+9uQy4t8ztVGajXX5e/WuQ27v8 tuEmchFzBznP3yJ7km/eUT1Vr7hWL3gZZtqPr3BtB33PkbiqJjTtiUVW6Cq7tv8= X-Gm-Gg: ASbGncvWKp2pXPoL0+rrgKjLOVpyql6l6YGq7XrVi65o9CkOuFbKwqPCJOslDti96jc X6gWvXZ1NQfGwB6EZgxj0gmxTU2GGyEh3M3OXdnv4GEMu2ll6HCoSYODwzYxcgLXZpEnwmyZRar q9uaTm0DqGN+EpgIW0h4K/ADcDAjzJj9IgJD7CMEyRt+9qCV34YwwDrsvuGnllKM2Akt2AinpFi Q7I/PMkh8WNmK3DFfG0jC74HV9Bd1v4uctrfQofK/hkwoojp4C6/caiscGys2NA X-Google-Smtp-Source: AGHT+IG27wfeYMQbSTxDwOz7Jah13F/6degbx6OGNBuq2fRCCebyOoNgchqtp/MSVdvmUbDhxY2IGg== X-Received: by 2002:a05:651c:1586:b0:300:3e66:5881 with SMTP id 38308e7fff4ca-3003e6658cfmr4086831fa.7.1733511644842; Fri, 06 Dec 2024 11:00:44 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:44 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sat, 7 Dec 2024 00:00:13 +0500 Message-Id: <20241206190015.4194153-3-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 32b32aa7e01f..800744a6c25b 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty = rswitch_next_queue_index(gq, false, 1)) { - desc = &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) != DT_FEMPTY) - break; - + desc = &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) == DT_FEMPTY) { dma_rmb(); + skb = gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] = NULL; } + desc->desc.die_dt = DT_EEMPTY; + gq->dirty = rswitch_next_queue_index(gq, false, 1); + desc = &gq->tx_ring[gq->dirty]; } } @@ -1685,6 +1685,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; + dma_wmb(); /* ensure that hw won't start and complete before + skb pointer was saved */ + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { desc = &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1698,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd goto err_unmap; } - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur = rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); From patchwork Fri Dec 6 19:00:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897582 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f170.google.com (mail-lj1-f170.google.com [209.85.208.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 747F1204577 for ; Fri, 6 Dec 2024 19:00:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511650; cv=none; b=fnXjFC40bLEgmP0D72KOhVNTVFAUMZ4h9RRiIOxWQ3qPayQ9vEGGKNhVdR2W6nqNn2ja2JmxvfxsqUml24vj6gUX0Uv4M0bE//6Y2AmKIVkfhUrIjpz9Cra/Pl7fh+SYBiZEaUg1neUN8P26u5z6wPpKzVvsbH9ks7V2an0jcSI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511650; c=relaxed/simple; bh=KWMNtKFHSXqIJRHh07Fhy/LOB/evmZgba6wRNVyYg70=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=br19pOYnsN1vV0rk/T3irK8gSD8iQTc1/6WyVnjDWAHTRlp08HYgWjoO1zyRvO/Q9hDIrfeXuOxpDjUKSnzkmuJXHcl3pDvRWnhBQN2pyCxlDrPWa/+oSP46+8TlENpqtTyjjmSklS8PuaW6P+VI78E+VGCMWsYsROjy4peYmIc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=AaKeSLfv; arc=none smtp.client-ip=209.85.208.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="AaKeSLfv" Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-3001d009633so21813051fa.0 for ; Fri, 06 Dec 2024 11:00:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511647; x=1734116447; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=i2QojkySpM8U2FoZ7dctDq5YFcwKebuv3WnOzhKxOok=; b=AaKeSLfvAuYARQhOkn8ve0wlftNC3sC4ypk8JATHhwRbT06adA4sEHbDxd8YS3B28S mghGDaUCR1vHjKf3lrNzzBaG+NCBEScUvZg66xGYtsvT45/np4RPkXpjqEGAAMS10KHz hVg9pkvb7tNwTcXU9fYL07Sas/g9B6ndgGwZa7Oc6fBpOJlhVQrTYfPgu9fLhzqr/0SU 7HNZHM+Otz6zC5l/5D3MMxPhh6o1koCSubufpkIZ6W3Od+as8eM51326nZlXRvmP490p J0gdAQHgQ+6fc9TyfKGllHvk6P1/GJSIa8Oi5OL/gKPPmt5JsmSucpte1FmlZSEtOpED KtyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511647; x=1734116447; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=i2QojkySpM8U2FoZ7dctDq5YFcwKebuv3WnOzhKxOok=; b=WWRM2u3Kl+iXiWt8pkqR9f7YW3WzHc0UVTplo4cJaRfnXiOZhKuFT8t332HcmEvJi7 gKmhdlRH49zj2Qb2uArAyeFyJJ4XUbdO/wOk18psehbNeBEmWRjW0RKdfJF4VkSLN/wJ FBMbAUEFcvJnyvOEcvq2esEX45a1JCLz5rHxh1ReFFUXsWdwzkzNtcD/iwlG0Hugq/d0 1tezlOO0dnW+bZ3xsN8zrn2bhW5FlsrCDthrd22rRWFpTKMOVsHrNYxj2Ows3sejOOzz /hDkx7/BRdfRSO1NZq8YjCK7i0Rg+OzTRdP4qgy3T3J8T7+WzDdRyTe1hI7sHqxsl8Pj v+Kw== X-Forwarded-Encrypted: i=1; AJvYcCU6qhViZMk/Rua/qvV63OTnxQ1sLF0wlTLJpAobSOsnn9A4yPdUauqcWgKkFVOvVL6skIwtGzTPJ/EcyIVMcbkZWw==@vger.kernel.org X-Gm-Message-State: AOJu0YzwtBeFwofyFuEad2xU9nRXvZjwfgLGNgcD+gz07afJtOGUK7hh rKR3hPtdRRRFiYCnRkFPFrfnyJNtPA6YdVh8cN7aOqfLUu9XxNVT/8PDfvJaQgY= X-Gm-Gg: ASbGncukEnLpTMm4jmM6xs6YbjyQAT954fSLSItQBfP97towj6nYSgELSEQXFoqGXGJ nKSZlBjuHhtiOkujUw/FLB9XzixFbCPFmLmH8YolkBYiAcVik0xpn4xE415Q0edh/4L7mOkKpGN aYP9XLTBZ1fMQuervywnV8E6VKjON9Dl2UL4vCI9dqJwney1nwS5HPmR9qBt/lVB1ZKPJkdU+SD Il9iiFSdq01YuB0JuF1q6Ler9StvIte4xchZTXnv1EHHEkZj+4IFwwmKcMsH8IG X-Google-Smtp-Source: AGHT+IEIsm4wQVX3IM84rN3fxaWi6YpUjvzeeTe6nAk1y92eqqKLDaXUQfpaQtMa2bkKEiL1wi3iHg== X-Received: by 2002:a2e:bd14:0:b0:300:2278:9b1f with SMTP id 38308e7fff4ca-3002fd1b175mr15585421fa.39.1733511646671; Fri, 06 Dec 2024 11:00:46 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:46 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 3/4] net: renesas: rswitch: fix leaked pointer on error path Date: Sat, 7 Dec 2024 00:00:14 +0500 Message-Id: <20241206190015.4194153-4-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If error path is taken while filling descriptor for a frame, skb pointer is left in the entry. Later, on the ring entry reuse, the same entry could be used as a part of a multi-descriptor frame, and skb for that new frame could be stored in a different entry. Then, the stale pointer will reach the completion routine, and passed to the release operation. Fix that by clearing the saved skb pointer at the error path. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 800744a6c25b..9c55f3480678 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1704,6 +1704,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd return ret; err_unmap: + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = NULL; dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE); err_kfree: From patchwork Fri Dec 6 19:00:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13897583 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f172.google.com (mail-lj1-f172.google.com [209.85.208.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30AB1205519 for ; Fri, 6 Dec 2024 19:00:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511651; cv=none; b=gG5q8hP8pWdF5naB5ad4diWbFQsvLEsSNn2fSQv9uhimCbS3n2aqwd+0Ck0SGAMncYzkib+DA7NpL1kARbUH+4sqERM7aNzXm4KAR+H9vvEWlwSetDR7W6F7lwxqZvDY+g5vydsKyQoVzxvCrqtbvK9kKuTerJgFkHbbAr5jjKc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511651; c=relaxed/simple; bh=Oug/7vDlEmuLkveQoKotO5NLIXni795nVP0v+lTs4CA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jq1fxX2oIxFt04ronmz1+CuN/q8QwJuburIzNMJSc+iQTL20bIpPeGiWUt+fyNu3XXWPWArTtSODrvqFqrYYb3S/Lw1WkDt+5/5HXdbH/IZKBndFj9LV2lfG3xJPEJmtnbTjwrUatlgN8LXtCVNrC+NuaMs5nIbdYhKxelEjhG4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=I29150/l; arc=none smtp.client-ip=209.85.208.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="I29150/l" Received: by mail-lj1-f172.google.com with SMTP id 38308e7fff4ca-2ffa8df8850so28183841fa.3 for ; Fri, 06 Dec 2024 11:00:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511648; x=1734116448; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NRtfoUuaiSmawV3D7PM8LTv0BVbgF0vB56WhOBoL48I=; b=I29150/l5AMSvygq3eX4FGWfKPNihBpQA0nMV66C2E3x1KYlSmxXPmBOaNKQGpDeji Y06PhD+v5If38T6CvvXmhm5hvTSAwcrQ+mvFGhUZLMduRx6lF6SSxxpvtN4wBYFt3esU Ec/K/x6NxsQOB/1iVOEKlMNRu0hWmwQkl6UOURgVKFL7S/OJIHr4PC3NtVY+SacmRAPF kAmr5hgd4cfkSUfYGedSgUKSzqFEOkp18d2mWqn/uluatfx+cB4R7yTRRhweftPl8qfB oRCuxqehyRBiQWlxwqesMN/t+dAkHokqVIlEAMRzh7iF46K8UrCuPqGhcTCeyJdlegZq 21NA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511648; x=1734116448; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NRtfoUuaiSmawV3D7PM8LTv0BVbgF0vB56WhOBoL48I=; b=Hmie/1MGti/ps8Z5jaV6xjgnyO/fKkskReNAcKRjU8TNXV2i6itt+JbS5wlJu2n60G QpemT8K6hcBqzXZyLO+1O06dvhRVAofx//0/AdEBVAmky5pQ2lZQwnpowNQ1zGx58PV1 S0KKlknhJqJqlfQJUcyNP3JnegPpgJzp6l0YAYVOK1GfnG88WvgZRXmr5yyZ+/vdS3kz IuELtbJ21t12VmGb+e5+2OP+AWZ6+lTupXwoOBbB2utLeUWcZujMn4sg/AcPx2K7s26Q DaztClDkw1xg2eAhYOHN2oIuHhOGVW3onOo0lXtW4zuMOdP7SezfYje9dcw1BHOMxyc7 c5Cg== X-Forwarded-Encrypted: i=1; AJvYcCWPyGRnbAea2vQ0ExW1lqUhNMNQNxKpIhdEG4PK8kNqCs3LpQqaAc8YVZQ4Qpxx7pcbZnvQYQEjn3pfd0P2Bu6rYw==@vger.kernel.org X-Gm-Message-State: AOJu0YwjX5YmTQAoelk1ENYyBDg/tlyC9erF0p0E6FnSIs9+ioVKze68 Feamhz2WhA7hE7lWH7ObQf1NgQs5JpVFRnq3Ac9k7sUfScZiMGi9oHsZg+dx9Io= X-Gm-Gg: ASbGncvCe+krwB6KqV8Ml4F77IZinIO8vWK81ri3P5i/VnKrLivvGADxZYEOi/4x20y 84qAEf/49BVVGkHyVIoUEsgS1y7V9EosOmORFkgCY+XfagVuvztTo73Lsgx1zGkGNw926i13vAh xSCLEiucFyFWxELemqjDw+MfNQ9Ry5Xn8H1jSav8i7j1GMQjEnuGUP19xZAj0mqpGE43hZEqx27 GdM6xf5KYVgBJqjN1tXPFeNM8vQna+7HFQWezQxu7dOdhegF7kF53N3xRBHoNUT X-Google-Smtp-Source: AGHT+IHHUgZX1u6gj5ZZhnbZvFvdFxtWjem7qzmC9NdGd/PDARE/4bpEVRG4Dg3PrMiq11s8UCNfVg== X-Received: by 2002:a2e:b88c:0:b0:300:3a15:8f26 with SMTP id 38308e7fff4ca-3003a1592e3mr14869321fa.0.1733511648446; Fri, 06 Dec 2024 11:00:48 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:48 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 4/4] net: renesas: rswitch: avoid use-after-put for a device tree node Date: Sat, 7 Dec 2024 00:00:15 +0500 Message-Id: <20241206190015.4194153-5-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 9c55f3480678..57cf211ac1e1 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1892,7 +1892,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1922,6 +1921,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1935,6 +1935,7 @@ static void rswitch_device_free(struct rswitch_private *priv, unsigned int index rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); }