net: mscc: fix in frame extraction
diff mbox series

Message ID 20200217083133.20828-1-horatiu.vultur@microchip.com
State Accepted
Commit a81541041ceb55bcec9a8bb8ad3482263f0a205a
Headers show
Series
  • net: mscc: fix in frame extraction
Related show

Commit Message

Horatiu Vultur Feb. 17, 2020, 8:31 a.m. UTC
Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted
by reading chuncks of 4 bytes from a register.

In case the IFH and frames were read corretly it would try to read the next
frame. In case there are no more frames in the queue, it checks if there
were any previous errors and in that case clear the queue. But this check
will always succeed also when there are no errors. Because when extracting
the IFH the error is checked against 4(number of bytes read) and then the
error is set only if the extraction of the frame failed. So in a happy case
where there are no errors the err variable is still 4. So it could be
a case where after the check that there are no more frames in the queue, a
frame will arrive in the queue but because the error is not reseted, it
would try to flush the queue. So the frame will be lost.

The fix consist in resetting the error after reading the IFH.

Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
---
 drivers/net/ethernet/mscc/ocelot_board.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Alexandre Belloni Feb. 17, 2020, 9:20 a.m. UTC | #1
On 17/02/2020 09:31:33+0100, Horatiu Vultur wrote:
> Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted
> by reading chuncks of 4 bytes from a register.
> 
> In case the IFH and frames were read corretly it would try to read the next
> frame. In case there are no more frames in the queue, it checks if there
> were any previous errors and in that case clear the queue. But this check
> will always succeed also when there are no errors. Because when extracting
> the IFH the error is checked against 4(number of bytes read) and then the
> error is set only if the extraction of the frame failed. So in a happy case
> where there are no errors the err variable is still 4. So it could be
> a case where after the check that there are no more frames in the queue, a
> frame will arrive in the queue but because the error is not reseted, it
> would try to flush the queue. So the frame will be lost.
> 
> The fix consist in resetting the error after reading the IFH.
> 
> Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

> ---
>  drivers/net/ethernet/mscc/ocelot_board.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
> index b38820849faa..1135a18019c7 100644
> --- a/drivers/net/ethernet/mscc/ocelot_board.c
> +++ b/drivers/net/ethernet/mscc/ocelot_board.c
> @@ -114,6 +114,14 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
>  		if (err != 4)
>  			break;
>  
> +		/* At this point the IFH was read correctly, so it is safe to
> +		 * presume that there is no error. The err needs to be reset
> +		 * otherwise a frame could come in CPU queue between the while
> +		 * condition and the check for error later on. And in that case
> +		 * the new frame is just removed and not processed.
> +		 */
> +		err = 0;
> +
>  		ocelot_parse_ifh(ifh, &info);
>  
>  		ocelot_port = ocelot->ports[info.port];
> -- 
> 2.17.1
>
David Miller Feb. 17, 2020, 10:06 p.m. UTC | #2
From: Horatiu Vultur <horatiu.vultur@microchip.com>
Date: Mon, 17 Feb 2020 09:31:33 +0100

> Each extracted frame on Ocelot has an IFH. The frame and IFH are extracted
> by reading chuncks of 4 bytes from a register.
> 
> In case the IFH and frames were read corretly it would try to read the next
> frame. In case there are no more frames in the queue, it checks if there
> were any previous errors and in that case clear the queue. But this check
> will always succeed also when there are no errors. Because when extracting
> the IFH the error is checked against 4(number of bytes read) and then the
> error is set only if the extraction of the frame failed. So in a happy case
> where there are no errors the err variable is still 4. So it could be
> a case where after the check that there are no more frames in the queue, a
> frame will arrive in the queue but because the error is not reseted, it
> would try to flush the queue. So the frame will be lost.
> 
> The fix consist in resetting the error after reading the IFH.
> 
> Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>

Applied and queued up for -stable.

Patch
diff mbox series

diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
index b38820849faa..1135a18019c7 100644
--- a/drivers/net/ethernet/mscc/ocelot_board.c
+++ b/drivers/net/ethernet/mscc/ocelot_board.c
@@ -114,6 +114,14 @@  static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
 		if (err != 4)
 			break;
 
+		/* At this point the IFH was read correctly, so it is safe to
+		 * presume that there is no error. The err needs to be reset
+		 * otherwise a frame could come in CPU queue between the while
+		 * condition and the check for error later on. And in that case
+		 * the new frame is just removed and not processed.
+		 */
+		err = 0;
+
 		ocelot_parse_ifh(ifh, &info);
 
 		ocelot_port = ocelot->ports[info.port];