All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jonas Suhr Christensen <jsc@umbraculum.org>
To: netdev@vger.kernel.org
Cc: jsc@umbraculum.org, "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Michal Simek <michal.simek@xilinx.com>,
	Harini Katakam <harini.katakam@amd.com>,
	Haoyue Xu <xuhaoyue1@hisilicon.com>,
	huangjunxian <huangjunxian6@hisilicon.com>,
	Wang Qing <wangqing@vivo.com>,
	Yang Yingliang <yangyingliang@huawei.com>,
	Esben Haabendal <esben@geanix.com>,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH net v2 1/2] net: ll_temac: Fix DMA resources leak
Date: Sun,  5 Feb 2023 21:11:27 +0100	[thread overview]
Message-ID: <20230205201130.11303-2-jsc@umbraculum.org> (raw)
In-Reply-To: <20230205201130.11303-1-jsc@umbraculum.org>

Add missing conversion of address when unmapping dma region causing
unmapping to silently fail. At some point resulting in buffer
overrun eg. when releasing device.

Fixes: fdd7454ecb29 ("net: ll_temac: Fix support for little-endian platforms")

Signed-off-by: Jonas Suhr Christensen <jsc@umbraculum.org>
---
 drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1066420d6a83..74423adbe50d 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -299,6 +299,7 @@ static int temac_dcr_setup(struct temac_local *lp, struct platform_device *op,
 static void temac_dma_bd_release(struct net_device *ndev)
 {
 	struct temac_local *lp = netdev_priv(ndev);
+	struct cdmac_bd *bd;
 	int i;
 
 	/* Reset Local Link (DMA) */
@@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev)
 	for (i = 0; i < lp->rx_bd_num; i++) {
 		if (!lp->rx_skb[i])
 			break;
-		dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys,
+
+		bd = &lp->rx_bd_v[i];
+		dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys),
 				 XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE);
+		bd->phys = 0;
+		bd->len = 0;
 		dev_kfree_skb(lp->rx_skb[i]);
+		lp->rx_skb[i] = NULL;
 	}
 	if (lp->rx_bd_v)
 		dma_free_coherent(ndev->dev.parent,
-- 
2.39.1


WARNING: multiple messages have this Message-ID (diff)
From: Jonas Suhr Christensen <jsc@umbraculum.org>
To: netdev@vger.kernel.org
Cc: jsc@umbraculum.org, "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Michal Simek <michal.simek@xilinx.com>,
	Harini Katakam <harini.katakam@amd.com>,
	Haoyue Xu <xuhaoyue1@hisilicon.com>,
	huangjunxian <huangjunxian6@hisilicon.com>,
	Wang Qing <wangqing@vivo.com>,
	Yang Yingliang <yangyingliang@huawei.com>,
	Esben Haabendal <esben@geanix.com>,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH net v2 1/2] net: ll_temac: Fix DMA resources leak
Date: Sun,  5 Feb 2023 21:11:27 +0100	[thread overview]
Message-ID: <20230205201130.11303-2-jsc@umbraculum.org> (raw)
In-Reply-To: <20230205201130.11303-1-jsc@umbraculum.org>

Add missing conversion of address when unmapping dma region causing
unmapping to silently fail. At some point resulting in buffer
overrun eg. when releasing device.

Fixes: fdd7454ecb29 ("net: ll_temac: Fix support for little-endian platforms")

Signed-off-by: Jonas Suhr Christensen <jsc@umbraculum.org>
---
 drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1066420d6a83..74423adbe50d 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -299,6 +299,7 @@ static int temac_dcr_setup(struct temac_local *lp, struct platform_device *op,
 static void temac_dma_bd_release(struct net_device *ndev)
 {
 	struct temac_local *lp = netdev_priv(ndev);
+	struct cdmac_bd *bd;
 	int i;
 
 	/* Reset Local Link (DMA) */
@@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev)
 	for (i = 0; i < lp->rx_bd_num; i++) {
 		if (!lp->rx_skb[i])
 			break;
-		dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys,
+
+		bd = &lp->rx_bd_v[i];
+		dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys),
 				 XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE);
+		bd->phys = 0;
+		bd->len = 0;
 		dev_kfree_skb(lp->rx_skb[i]);
+		lp->rx_skb[i] = NULL;
 	}
 	if (lp->rx_bd_v)
 		dma_free_coherent(ndev->dev.parent,
-- 
2.39.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  reply	other threads:[~2023-02-05 20:12 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-02-05 20:11 [PATCH net v2 0/2] Fix dma leaking Jonas Suhr Christensen
2023-02-05 20:11 ` Jonas Suhr Christensen
2023-02-05 20:11 ` Jonas Suhr Christensen [this message]
2023-02-05 20:11   ` [PATCH net v2 1/2] net: ll_temac: Fix DMA resources leak Jonas Suhr Christensen
2023-02-06 10:19   ` Katakam, Harini
2023-02-06 10:19     ` Katakam, Harini
2023-02-07  7:59   ` esben
2023-02-07  7:59     ` esben
2023-02-07 11:27   ` Paolo Abeni
2023-02-07 11:27     ` Paolo Abeni
2023-02-07 11:36     ` Paolo Abeni
2023-02-07 11:36       ` Paolo Abeni
2023-02-07 18:42       ` Jakub Kicinski
2023-02-07 18:42         ` Jakub Kicinski
2023-03-13 18:37         ` Jonas Suhr Christensen
2023-03-13 18:37           ` Jonas Suhr Christensen
2023-03-13 18:48           ` Jakub Kicinski
2023-03-13 18:48             ` Jakub Kicinski
2023-03-14  5:15             ` Katakam, Harini
2023-03-14  5:15               ` Katakam, Harini
2023-07-08 13:15               ` Christophe JAILLET
2023-07-08 13:15                 ` Christophe JAILLET
2023-07-10  5:51                 ` Katakam, Harini
2023-07-10  5:51                   ` Katakam, Harini
2023-09-20 11:56                   ` Katakam, Harini
2023-09-20 11:56                     ` Katakam, Harini
2023-02-05 20:11 ` [PATCH net v2 2/2] net: ll_temac: Reset buffer on dma_map_single() errors Jonas Suhr Christensen
2023-02-05 20:11   ` Jonas Suhr Christensen
2023-02-06  9:59   ` Katakam, Harini
2023-02-06  9:59     ` Katakam, Harini
2023-02-07  7:59   ` esben
2023-02-07  7:59     ` esben

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230205201130.11303-2-jsc@umbraculum.org \
    --to=jsc@umbraculum.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=esben@geanix.com \
    --cc=harini.katakam@amd.com \
    --cc=huangjunxian6@hisilicon.com \
    --cc=kuba@kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=michal.simek@xilinx.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=wangqing@vivo.com \
    --cc=xuhaoyue1@hisilicon.com \
    --cc=yangyingliang@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.