From patchwork Sun Dec 8 09:50:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898515 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f174.google.com (mail-lj1-f174.google.com [209.85.208.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8DB6013B7BE for ; Sun, 8 Dec 2024 09:50:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651415; cv=none; b=S9rjKiRQfwdEwDGjzv/Gh3ETveRfTSc4Jkl8o0O4VapQ1f48aaFhCTLRmyBjVFA15pjNt33ixWbVnx9na1sWcXlE2D1mZwoA6AAgKVpBhGESIvysPXS1aym6t2v0r7QOfC3g9bJQpMUR5RAFEd6FY2CSYNDr90we926GvGXr7cU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651415; c=relaxed/simple; bh=SI27lQ6ouPyc6VSvj6mijRBvLjbpSdfHHV2X5cxHAlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=MmXVwE2ZEf6NIfcKN3BJ2g+obLp+jzebcKXVT4oSFTrcvJF/Pj0XvJ/q9moCb/nbmH5asdB+13ke0LQqoxJcerd/T/cT0c4P4GSbmSMCnnpg0WP6aCRp3FLHsRJF7BOMqpe1aqTpDmSpVSvKa2DfNG5SfDaFP5jM56A7j86T+UA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=qJwWDtA8; arc=none smtp.client-ip=209.85.208.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="qJwWDtA8" Received: by mail-lj1-f174.google.com with SMTP id 38308e7fff4ca-2ffbf4580cbso34658821fa.2 for ; Sun, 08 Dec 2024 01:50:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651412; x=1734256212; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=qJwWDtA8HYNQUxBJnk5UQAwTob5KH7pl9B6Ae1iyRzoO/77/FJsXTu9ch/SrstK+wl YL1AEeug/zISOaQddiI2/m0qDpX+tiAo7chTJRhzLKKx0LYBIbTIexPJELJ5onZ6aOnk GTYW3mu4Dwnz73cDbodVXNHQaQYh5Zvw3gOZCnnsVmqeJw1D5yAj/g2p8sUPcX0C1l8c GgW8bQx2xYQqT/6ix2CLR8nAvNYrQw7TvihpnwEkdKRAefcK5Z4ohY5kbgXRSs5Mrs80 bdN39B/e2cCwhUGOjb1I9w5ZuJVNMsttzqIe7Dh7qJkZDIRWOfLvNvj9gRPwGcmCaJOr XiYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651412; x=1734256212; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=UnLQz0FUiZ3wlih//TItrtbMje7d51vZ4wyMGjfI9SGqwk1k/vho/4ykyP5yHvkaqf uq5RmWbAsqEWogpo5bObeot3/b0HtUVa5SnCU30KivcqiduFaw8pEzGGxIWrZRwAronD /uE3jNWXalDBI5CdUigT/6FLOkqZJgnQKfVy8NoPAH2MNharHgRpiJS9SGlhxf/WQZRk I+T4AGUKqcyVWWGyTr4yTruu7ojX+uR2p4Ea/kHM6DLzPhG5r0Lt8eQFyDugTZNbvgOX +xo3XtQ+OAH1Jf6YBJ+Xr/loTGKgVwL1mCicOyeGEx93VXtbN+r/cKuL2iLpq3IcQLpD lIoA== X-Forwarded-Encrypted: i=1; AJvYcCWwqmlNMSFlRfs3l9WFGdsSPDdVd+amoaf99/ajLYfUnfV8nyqMX7+YYTho4KAmFLE0pDEXij7FcI9GrjKjLIP43g==@vger.kernel.org X-Gm-Message-State: AOJu0YzStpSNInCl2X1lBdN2KyNYlaWtaZo8n9vin59Fs4cRtfsbRPsy JHHWsz2G8tNHdclXuoEXJIaNDj/o4c7zjUl41tMFE2ijIQZlPZ1grK2lt4vwsvw= X-Gm-Gg: ASbGncuMVniZy8Q4T8WvIDJ4MBkjjruMEKjKD1AlHhZ7bFKbSRtf3EkGnoIPRiFF7wB G+WEPeHzKGrmZfvZp/2UZaBiwQR1zMPYY7IOzKhG7VjWT0oiBJYi74hLhSbv0lHh6rAnZY4Ay3u ljXtBnEAb6nRdbMeV5Q204cyDGmJ+b+QKgsFt1szikjMgljp1dIngg5sEQxptJKFXuudmuX4exm e0rtcEP47kH3QnLqABk3qLu+uaK9pBm/Jb0GBVKc2Tg374jFiggN7tcL4Obal3z X-Google-Smtp-Source: AGHT+IGmOlhACGEiwReXdOmA2tPXqwQWewjxb6Ay7meV1g237ucqsf808iRNKjO6hZpq9iuPGcdG5g== X-Received: by 2002:a05:651c:1586:b0:300:3e66:5881 with SMTP id 38308e7fff4ca-3003e6658cfmr17033281fa.7.1733651411640; Sun, 08 Dec 2024 01:50:11 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:11 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 1/4] net: renesas: rswitch: fix possible early skb release Date: Sun, 8 Dec 2024 14:50:01 +0500 Message-Id: <20241208095004.69468-2-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index b80aa27a7214..32b32aa7e01f 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1681,8 +1681,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; - gq->skbs[gq->cur] = skb; - gq->unmap_addrs[gq->cur] = dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardware completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { From patchwork Sun Dec 8 09:50:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898516 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 270A2144304 for ; Sun, 8 Dec 2024 09:50:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651416; cv=none; b=Ju+zi4tBwwQieu9H3jhzDGlRb4HzK0T8etE4NHXZXhKA/p23Oviwtmd5W1x358h8ikKS73yU5uRbbMfc/Hmn6+62YG8EST3WEIl6TRvwmgX7ASta7MCIDT2Xixp8cYThWGuOlo/adszeReQKRWyN9w4TazzWTx0jyYJtj4xTQRQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651416; c=relaxed/simple; bh=wXdUfPDZdTp7uaCmZH8pm7BfzwNL7Ba4+AgLadvA+oE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=hMit8s9mnVp4tSOO2xB6gcqrP35YQXbLjbY3+BAg4+am5jmkuuzehHvc7C2HS2/h4Skyi/0Eco+axJgJmRFSm1r0N0Xo9I2tMSVTKsveeCeD4ziXWrrC7lMzZw08wxeKlZRHzh8NjccJa+NE8uqm1u/ZWFoii5q0J5WaTHeYLmc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=VOyNYOcq; arc=none smtp.client-ip=209.85.208.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="VOyNYOcq" Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-3002c324e7eso24734601fa.3 for ; Sun, 08 Dec 2024 01:50:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651413; x=1734256213; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=VOyNYOcqXtcI3aCNYRedaRVcOaFPSgTgnsDW1JqQD3s/C/3NnzJwJVPCd1TkgATPzf nt4UwqQWzNDhbwqL3TWfYdICpAb/b2LY+DRvtVlNMAHcaqIjDhwVpc7j/tbuc4czCv7U Ju0b31JTSxN7K0l5o/5yspnzzyTYRfYouZLvaKDTAEqJZQyvhtcUJd/Cyq2Jwr7w7JdZ K16SFeY0qMdvJ0LH/WDSbPaZZIzp7svCNisKyU1yOm0oCWdyHMX4wLR8FQSDCusp3hHe v6pqZ0kbObYDI3a483+JP6zgGJo/DbQ7ztkoD7CrKDTTBsccasIyC554v85uBUGeQzGe /8sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651413; x=1734256213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=m55AgWNxswtVi7U/j0sX0R5F7ywuS6zxaOY81vl5zEUtAhQlE9VWHeU7RQdb8FmyX8 lOvl5W2nyfppdo3SR0lQRPYXUYmmLaxa3ZzVkdjsbg1WOK1rrf2ttcZY7MlTQsQO40SN dN9QE4rUUFpoIC+ghEK2uaCJpxa9vOfbC1TXCTszVTWwWn95Riza3hPVG6+skG5BUlfH 1byVRpsRHC92ZubtG/ui57c5MGCWW30oLorGbLdgZTyUznTjrOf8UvfbL1as+GT5kvAq zyKuh8IiTki4+127asB8ewZo/g2YAx49OAt5vkn9OxTlJPm2gOlgIvagbiuoxprPtzuW BVeg== X-Forwarded-Encrypted: i=1; AJvYcCUDlQAhhKAdz/0eIXFpFNWNpi4JQRbw9pIlggH2HViN+33kJtMNTZBK1p1RMfrm5kY0l48phCQXjVvPKIRFe1p96A==@vger.kernel.org X-Gm-Message-State: AOJu0YwpdibU60jGz25AxwodPtX75XLpxcE7f9i4Rv41EECMIsyhQPAf riWPmaM65LDpYtQ8uFcnkPmLpAzXrKOkAa7XMCQAI0ycvlMWngC8aMR7+HD++EdXmoeSqFIVuRX HNEM= X-Gm-Gg: ASbGncvXHLhGQ+/2t8kK2LiA3EdBZE9Row4iFSjdyt5nx8IybIbpEMCXycg/Q9GGB5R NHojbLlZcBelsGeq0d7LqdrgSNsAJzubcjtoeoTydnbldvJbEd7szWZ+94Ya40mF6SAfCwUvZWX 1YzR4pvA453CFx05REPdhmylhaEfgpSBJje8sqPWfNVtJCmnoMPdVBKDvxY2rcbygsc081iPfOv PwVsOjAowolYHq4LKjRUMzYZs+wIroLGoZryl075sUteG56ZeUebgmHQcuGXfAR X-Google-Smtp-Source: AGHT+IHjfkWlUO9ktjjTWDVzSSef25MV2HxBTpd82UrqbQLyW1H2AFrdbCeLYV2NDHOM5jBn6C1seA== X-Received: by 2002:a2e:bccb:0:b0:2ff:55f0:ae4b with SMTP id 38308e7fff4ca-3002fc2585amr46517131fa.21.1733651413281; Sun, 08 Dec 2024 01:50:13 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:13 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sun, 8 Dec 2024 14:50:02 +0500 Message-Id: <20241208095004.69468-3-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 32b32aa7e01f..c251becef6f8 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty = rswitch_next_queue_index(gq, false, 1)) { - desc = &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) != DT_FEMPTY) - break; - + desc = &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) == DT_FEMPTY) { dma_rmb(); + skb = gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] = NULL; } + desc->desc.die_dt = DT_EEMPTY; + gq->dirty = rswitch_next_queue_index(gq, false, 1); + desc = &gq->tx_ring[gq->dirty]; } } @@ -1685,6 +1685,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; + dma_wmb(); + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i = nr_desc; i-- > 0; ) { desc = &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1697,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd goto err_unmap; } - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur = rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); From patchwork Sun Dec 8 09:50:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898517 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lf1-f52.google.com (mail-lf1-f52.google.com [209.85.167.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B905D147C71 for ; Sun, 8 Dec 2024 09:50:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651418; cv=none; b=k+jYa637A5kjXpRd8KNb9kuItKjd62BqHMptVNhDV+l/4OcKYTrQQeFCmh+FzU+cIYFRfDVyDzSUQp9tSYTmN1Em1gvzSjEYjPkvyXT29rYWA+eyvkx9+bV7wQysPcpTOUKxWSklv1tVttQQ6+UFG2xL9g3lnFfb4Zb7gl7cQso= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651418; c=relaxed/simple; bh=K2M2L/ZAYcnrWJuH8IzCe8Rtu47EQV2npWezrC5CH+Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PN3NqcyUynjEsidC8dqIVeqoeftd8V4rzMvaLVSZWNWW4DC9ANIeLqX6p9dTzO/UW4HT2otdW0QENUgoba5xgM2uRfLrHV5EDsRMDlvoyCah9cW8Xw0xWZDz3YCX1S6TFpddxO5hnw6bdhUtQJsOwdn24IhtBF/enXaSLWcZBmE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=sPCwhCBd; arc=none smtp.client-ip=209.85.167.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="sPCwhCBd" Received: by mail-lf1-f52.google.com with SMTP id 2adb3069b0e04-53de92be287so3364221e87.1 for ; Sun, 08 Dec 2024 01:50:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651415; x=1734256215; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=UJZ/cFgyayhBFYtEHeJoPJb1EWnv+22CKraiiow1EcU=; b=sPCwhCBdc6YMouvWYQ8hlPL3wknNBTqsfqp9NwAgaK4KIJ1VwbGcdu4fBlrTxG4z/z fGcVGMYcjb5364NRPfSkbz5+NGH2dMugSZ+Wctq0DV6IEZnH9zZD4ke5b6YllYRVUXuh ErUqENNfOBpO7MuuLuUMVE9Js0gVdeDL5xd05lnxsrhneTCzWFHo6to+ah6NjlT0f2f1 L5uzKOaA0qc5g5uB0yU1lUG4dnIEY9SOBj1G4lZdL6z4VWaGpuFL4vwchdcNPlMnyLsP jLUJg2TyiR2ByUOgq8wczKAqPzjtXhwJc/xXrbrb7eYm1Ab0bTM6vT3b6YSQR2BGgAUh LFTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651415; x=1734256215; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UJZ/cFgyayhBFYtEHeJoPJb1EWnv+22CKraiiow1EcU=; b=mBSD7nvI0Ig7H/LQ/Vt/pEDzfhhqGG5YUs4Caw6D8QImzARC8lid7i+T5Ad0fdIbo7 cuuqDFfVnWJ3aCCIjRPmJaeP4hXgkEingIjBjujVbCvaUGGz8R2Gcj0KOfe2I9hp0T1Z RPV1FX7x3Np5ZiGzukN1fMPY1zRkx3xMSqf5dw2Tv4YZtDfgTFfIZajq/T+oAUHrPycn IBAJKQi8smlhBF1nUs+wBOQsuLh1TtmloNjLSoJqMkXpfC4kxvnHYLE7X3M6YJYu2qIL sGS7LYylskzZp0Ia0PiE9F/uTYgB39ijS/yl4PkTMQ5vovMSesi5l43Ik13zQLgS9HcV 8/hA== X-Forwarded-Encrypted: i=1; AJvYcCVZaG1yQYY5g+Ibo5KgqD29VplRB/wBx9V3xbSvRR2qnGAa1O5fws9Pc3Sec1dWHSvO8XLYOOc+sV2D11yXTET08w==@vger.kernel.org X-Gm-Message-State: AOJu0Yx+4JkDaXO2I9wdVa8fG0sJsJ0zgGaumJZauT1Z+uWp9balB8Ts IqbGWtRRYCfB4wqmxs7qhDV5Zlf1gwQyVhMOzqwd7GP5Tuv9uBem/7B1m8aMzm8= X-Gm-Gg: ASbGncsKW/s/MOHs6Woprgvq9c7Y4kY6lAlQWZpHby1UnCv4rmWwgoPic749gQ8ijj2 jS/IFimqdPwK3ztSnBItEIci9PzCgeq23Xu1gqvtU+md6O45Razs/3p2SWqwMOVInT9OP1ivBIa H2ZXx6BJF8AvUSpBqUD5WQJN7yHBlKeTqlUsxB/zLi6VPeE7nXTKoUBEoFRHJYABRkT/EPku/Pd smxXMbEYVgre/wnUgriwYobuMnLUXOJFzZyh88KyeZST2awAL2vuFXtFLyAZoDi X-Google-Smtp-Source: AGHT+IEg2JUCxfsh/bJ+hiKC7kKcxPI03So5n7bJFcOp4QMs6n7AD95qHIYMZq9Fveaz33U6ohLDAg== X-Received: by 2002:a2e:b88e:0:b0:302:1d24:8db9 with SMTP id 38308e7fff4ca-3021d249048mr4578011fa.20.1733651414953; Sun, 08 Dec 2024 01:50:14 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:14 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 3/4] net: renesas: rswitch: fix leaked pointer on error path Date: Sun, 8 Dec 2024 14:50:03 +0500 Message-Id: <20241208095004.69468-4-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If error path is taken while filling descriptor for a frame, skb pointer is left in the entry. Later, on the ring entry reuse, the same entry could be used as a part of a multi-descriptor frame, and skb for that new frame could be stored in a different entry. Then, the stale pointer will reach the completion routine, and passed to the release operation. Fix that by clearing the saved skb pointer at the error path. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index c251becef6f8..af0bc95ad6ae 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1703,6 +1703,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd return ret; err_unmap: + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = NULL; dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE); err_kfree: From patchwork Sun Dec 8 09:50:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Yushchenko X-Patchwork-Id: 13898518 X-Patchwork-Delegate: geert@linux-m68k.org Received: from mail-lj1-f171.google.com (mail-lj1-f171.google.com [209.85.208.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E6CD14A4CC for ; Sun, 8 Dec 2024 09:50:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651421; cv=none; b=ad8uT5In+bcSirIVsSZbm9sBKn5HYLewWZvhVIaEwXLQiU8VBUlVH9+qSo5Il9e0MBJWDygF1OdS3gYlR7XxQxIWc/m/aqGho7pS/vA34UJ2EWLdvaCAjrZlz38jKoxFuP6JGyJnwe2hKDisxBgsFRWmQwd6kbepFmbHGevPAEQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651421; c=relaxed/simple; bh=m3xLhEgvkVumCBPK7rvot6sHsRzw5hUEzzHNk/EM1Jw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=cBtJWmTa9pl0JOOz1pMpMPK3BqheUPvqYHXRcbX2PWgK1rblLJxjYrLRiRtRldgBGkugiga9X88YUMiqrgYY4Px37CGRS5+/XM1crTQa4Z6EfBeouRKosQhwvjjsdCDEGVV3RbRVmWTogDo5GBQFSMNDpsKniAxLASm4E1qrYzY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=EnLovTV1; arc=none smtp.client-ip=209.85.208.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="EnLovTV1" Received: by mail-lj1-f171.google.com with SMTP id 38308e7fff4ca-30033e07ef3so19721271fa.0 for ; Sun, 08 Dec 2024 01:50:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651417; x=1734256217; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qi9ee4q7wG9Z60y8ibg5HDfGF5CuB96sJUYWCS5oeVQ=; b=EnLovTV1hVXNz3iGbnvlrJwcGiUA+4QEgF7a76lEXrH0MowfFGGmST3lT+Vg9EZEOI M1AdhvjdWrGkXFqF6XebsOe2aU5z1oYHI8PSVanWWqGRXiSbET4iKKLOehkkytNN86QX cz3lC87U3WqQDd+aMkjr4EUW39ddEYS2EPt79n9xdRkSBCcsxmvNrEjosq6uyv2nMan4 j1CwFmcwBvOyK9oU3If5pwoLQKjofhhFWjTJXpGt12v9dKBRh245PaLq4uyCDRADzJtm Dmb+cWLBHAMkGd+eJNRyW/pO1KUagLh3vtJFjS0S30UXIACZqSE/GgG5s0TpCdvM4jSz elXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651417; x=1734256217; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qi9ee4q7wG9Z60y8ibg5HDfGF5CuB96sJUYWCS5oeVQ=; b=Qs7ewwNK6mwk9qicwrXHeOqWtouvlmzSfFbyOJt3MtLS2qwK6dW3Pml3wEmfFBPcdy 8vi+OaJfw3wDy0aLJsiXHKR7ZQkpacT6vpHNgGBG5XoqcTRMVuR5t7uKmXDxXMk+uTdk jCiY6r/tznP/tEMn9tOXR5J3NGsc/ALBamXuqHutQ4FTDt3nwTA7ec87LwRbzojDDnNP nD4NTpAMru9iqGn5t9gZoar8A8TKWdsPxQsGK14BQdjPGy2CyPTkuZP582JeU0Yz42Hs jkFa6PcV5k4WKTTl86MzVYjMIcbNGraHX/mq2TG8aWxecjRLsaExh9ZbxTH9MyyQu061 kQrA== X-Forwarded-Encrypted: i=1; AJvYcCXkJGUqtwaK0bvtmq/Cb0y6iCwRshTXHT8rZy9itscc7sYpLgAlNu18mncJ1eedz6j6tirvgRVoJM0AlGETJPsuXw==@vger.kernel.org X-Gm-Message-State: AOJu0YxmUZVMBDoc9nB0jqSBmIXMOMDAbSjlpN3eiVRpQ6ly8Bi0baYQ 0HD3L6fSKExGilzTU2tkGuRKRNn/B71uxcxnN/mfulqcuMxJm9R8jjMjqHDkIQE= X-Gm-Gg: ASbGncvOUQTBkECJh7zVVJ649aE/3wdcYaBvOxbQY0Nt2EKP9GD4vCucrFtpxHe9LGI V97zv1uSvCYt1DwLZyYyDLT8oMqjVaouFpvZ7leqKLqpxj6Xk8HN2prlppCiHZPbBm2fcCdX0/q hewhmxjhww2t95t6zp+zGvCxtTfWS1EIC5nXcQbaLNvZIb8Od+ypfG75Cg76SrDtcJGKmj4GqfC kwqBs3Bt9RZinuIT5zSrZoqNMCW5vdK994EHg0FDn04Nv5dzLXjFUhTdCD0KRHA X-Google-Smtp-Source: AGHT+IGMZmYJjHnUsc238RV3yY9xHt3nqaPN8mYEXiS21C8jUq0UJbg1npLyXNDZJfghXQMbM8fRmg== X-Received: by 2002:a2e:a10e:0:b0:300:11e4:ce2d with SMTP id 38308e7fff4ca-3002deff095mr31481261fa.20.1733651416628; Sun, 08 Dec 2024 01:50:16 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:16 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 4/4] net: renesas: rswitch: avoid use-after-put for a device tree node Date: Sun, 8 Dec 2024 14:50:04 +0500 Message-Id: <20241208095004.69468-5-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-renesas-soc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index af0bc95ad6ae..3b57abada200 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1891,7 +1891,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1921,6 +1920,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1934,6 +1934,7 @@ static void rswitch_device_free(struct rswitch_private *priv, unsigned int index rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); }