netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: George Spelvin <lkml@sdf.org>
To: michael.chan@broadcom.com, netdev@vger.kernel.org
Cc: hauke@hauke-m.de, lkml@sdf.org
Subject: [RFC PATCH 2/4] b44: Fix off-by-one error in acceptable address range
Date: Sun, 8 Dec 2019 08:36:48 GMT	[thread overview]
Message-ID: <201912080836.xB88amHd015549@sdf.org> (raw)

The requirement is dma_addr + size <= 0x40000000, not 0x3fffffff.

In a logically separate but overlapping change, this patch also
rearranges the logic for detecting failures to use a goto rather
than testing dma_mapping_error() twice.  The latter is expensive if
CONFIG_DMA_API_DEBUG is set, but also for bug-proofing reasons I try to
avoid having the same condition in two places that must be kept in sync.

Signed-off-by: George Spelvin <lkml@sdf.org>
---
 drivers/net/ethernet/broadcom/b44.c | 42 ++++++++++++++++-------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 394671230c1c..e540d5646aef 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -680,12 +680,13 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
 
 	/* Hardware bug work-around, the chip is unable to do PCI DMA
 	   to/from anything above 1GB :-( */
-	if (dma_mapping_error(bp->sdev->dma_dev, mapping) ||
-		mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)) {
+	if (dma_mapping_error(bp->sdev->dma_dev, mapping))
+		goto workaround;
+	if (mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)+1) {
 		/* Sigh... */
-		if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
-			dma_unmap_single(bp->sdev->dma_dev, mapping,
-					     RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
+		dma_unmap_single(bp->sdev->dma_dev, mapping,
+				 RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
+workaround:
 		dev_kfree_skb_any(skb);
 		skb = alloc_skb(RX_PKT_BUF_SZ, GFP_ATOMIC | GFP_DMA);
 		if (skb == NULL)
@@ -693,10 +694,12 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
 		mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
 					 RX_PKT_BUF_SZ,
 					 DMA_FROM_DEVICE);
-		if (dma_mapping_error(bp->sdev->dma_dev, mapping) ||
-		    mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)) {
-			if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
-				dma_unmap_single(bp->sdev->dma_dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
+		if (dma_mapping_error(bp->sdev->dma_dev, mapping))
+			goto failed;
+		if (mapping + RX_PKT_BUF_SZ > DMA_BIT_MASK(30)+1) {
+			dma_unmap_single(bp->sdev->dma_dev, mapping,
+					 RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
+failed:
 			dev_kfree_skb_any(skb);
 			return -ENOMEM;
 		}
@@ -990,24 +993,27 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	mapping = dma_map_single_attrs(bp->sdev->dma_dev, skb->data, len,
 				       DMA_TO_DEVICE, DMA_ATTR_NO_WARN);
-	if (dma_mapping_error(bp->sdev->dma_dev, mapping) || mapping + len > DMA_BIT_MASK(30)) {
+	if (dma_mapping_error(bp->sdev->dma_dev, mapping))
+	       goto workaround;
+	if (mapping + len > DMA_BIT_MASK(30)+1) {
 		struct sk_buff *bounce_skb;
 
 		/* Chip can't handle DMA to/from >1GB, use bounce buffer */
-		if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
-			dma_unmap_single(bp->sdev->dma_dev, mapping, len,
-					     DMA_TO_DEVICE);
-
+		dma_unmap_single(bp->sdev->dma_dev, mapping, len,
+				 DMA_TO_DEVICE);
+workaround:
 		bounce_skb = alloc_skb(len, GFP_ATOMIC | GFP_DMA);
 		if (!bounce_skb)
 			goto err_out;
 
 		mapping = dma_map_single(bp->sdev->dma_dev, bounce_skb->data,
 					 len, DMA_TO_DEVICE);
-		if (dma_mapping_error(bp->sdev->dma_dev, mapping) || mapping + len > DMA_BIT_MASK(30)) {
-			if (!dma_mapping_error(bp->sdev->dma_dev, mapping))
-				dma_unmap_single(bp->sdev->dma_dev, mapping,
-						     len, DMA_TO_DEVICE);
+		if (dma_mapping_error(bp->sdev->dma_dev, mapping))
+		       goto failed;
+		if (mapping + len > DMA_BIT_MASK(30)+1) {
+			dma_unmap_single(bp->sdev->dma_dev, mapping, len,
+					 DMA_TO_DEVICE);
+failed:
 			dev_kfree_skb_any(bounce_skb);
 			goto err_out;
 		}
-- 
2.24.0

             reply	other threads:[~2019-12-08  8:42 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-08  8:36 George Spelvin [this message]
2019-12-09 17:29 ` [RFC PATCH 2/4] b44: Fix off-by-one error in acceptable address range Michael Chan
2019-12-09 18:01   ` George Spelvin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=201912080836.xB88amHd015549@sdf.org \
    --to=lkml@sdf.org \
    --cc=hauke@hauke-m.de \
    --cc=michael.chan@broadcom.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).