[PATCH] net: mscc: fix in frame extraction

[PATCH] net: mscc: fix in frame extraction

[Horatiu Vultur]

Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted
by reading chuncks of 4 bytes from a register.

In case the IFH and frames were read corretly it would try to read the next
frame. In case there are no more frames in the queue, it checks if there
were any previous errors and in that case clear the queue. But this check
will always succeed also when there are no errors. Because when extracting
the IFH the error is checked against 4(number of bytes read) and then the
error is set only if the extraction of the frame failed. So in a happy case
where there are no errors the err variable is still 4. So it could be
a case where after the check that there are no more frames in the queue, a
frame will arrive in the queue but because the error is not reseted, it
would try to flush the queue. So the frame will be lost.

The fix consist in resetting the error after reading the IFH.

Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
---
 drivers/net/ethernet/mscc/ocelot_board.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
index b38820849faa..1135a18019c7 100644
--- a/drivers/net/ethernet/mscc/ocelot_board.c
+++ b/drivers/net/ethernet/mscc/ocelot_board.c
@@ -114,6 +114,14 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
 		if (err != 4)
 			break;
 
+		/* At this point the IFH was read correctly, so it is safe to
+		 * presume that there is no error. The err needs to be reset
+		 * otherwise a frame could come in CPU queue between the while
+		 * condition and the check for error later on. And in that case
+		 * the new frame is just removed and not processed.
+		 */
+		err = 0;
+
 		ocelot_parse_ifh(ifh, &info);
 
 		ocelot_port = ocelot->ports[info.port];
-- 
2.17.1

Re: [PATCH] net: mscc: fix in frame extraction

[Alexandre Belloni]

On 17/02/2020 09:31:33+0100, Horatiu Vultur wrote:
> Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted
> by reading chuncks of 4 bytes from a register.
> 
> In case the IFH and frames were read corretly it would try to read the next
> frame. In case there are no more frames in the queue, it checks if there
> were any previous errors and in that case clear the queue. But this check
> will always succeed also when there are no errors. Because when extracting
> the IFH the error is checked against 4(number of bytes read) and then the
> error is set only if the extraction of the frame failed. So in a happy case
> where there are no errors the err variable is still 4. So it could be
> a case where after the check that there are no more frames in the queue, a
> frame will arrive in the queue but because the error is not reseted, it
> would try to flush the queue. So the frame will be lost.
> 
> The fix consist in resetting the error after reading the IFH.
> 
> Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

> ---
>  drivers/net/ethernet/mscc/ocelot_board.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
> index b38820849faa..1135a18019c7 100644
> --- a/drivers/net/ethernet/mscc/ocelot_board.c
> +++ b/drivers/net/ethernet/mscc/ocelot_board.c
> @@ -114,6 +114,14 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
>  		if (err != 4)
>  			break;
>  
> +		/* At this point the IFH was read correctly, so it is safe to
> +		 * presume that there is no error. The err needs to be reset
> +		 * otherwise a frame could come in CPU queue between the while
> +		 * condition and the check for error later on. And in that case
> +		 * the new frame is just removed and not processed.
> +		 */
> +		err = 0;
> +
>  		ocelot_parse_ifh(ifh, &info);
>  
>  		ocelot_port = ocelot->ports[info.port];
> -- 
> 2.17.1
> 

-- 
Alexandre Belloni, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] net: mscc: fix in frame extraction

[David Miller]

From: Horatiu Vultur <horatiu.vultur@microchip.com>
Date: Mon, 17 Feb 2020 09:31:33 +0100

> Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted
> by reading chuncks of 4 bytes from a register.
> 
> In case the IFH and frames were read corretly it would try to read the next
> frame. In case there are no more frames in the queue, it checks if there
> were any previous errors and in that case clear the queue. But this check
> will always succeed also when there are no errors. Because when extracting
> the IFH the error is checked against 4(number of bytes read) and then the
> error is set only if the extraction of the frame failed. So in a happy case
> where there are no errors the err variable is still 4. So it could be
> a case where after the check that there are no more frames in the queue, a
> frame will arrive in the queue but because the error is not reseted, it
> would try to flush the queue. So the frame will be lost.
> 
> The fix consist in resetting the error after reading the IFH.
> 
> Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>

Applied and queued up for -stable.