From nobody Wed Dec 17 19:43:39 2025 Received: from mail-lj1-f176.google.com (mail-lj1-f176.google.com [209.85.208.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E921D1953BA for ; Fri, 6 Dec 2024 19:00:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511646; cv=none; b=RzzQPiDa1AHKhNf/TYvkAhPU98kxsROWiI2MsF5HmIYC7tE56tRMr6bEfxYe3V/n26ybykfT9A+5rPDTKBQV+62rdLT+j7FSc5aVFA+daEwurKQajhUfWxr7eLTYkIIkTAWe7M1v6+brAx83u6tODCnzs681HiCiAK04F3qetns= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511646; c=relaxed/simple; bh=SI27lQ6ouPyc6VSvj6mijRBvLjbpSdfHHV2X5cxHAlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=AkzJe1yz1TB8ebJXsva6L+u5kFmFCwrAA3zXLuass1ugMXJJlymKUGGIhaQLhlJHItUEK0Xa4ur6z9fnHy6RPRRprDN86cU59Z5tmiJapEZTyKrUSozJM8a/jrxdUflrjtPdo1EKKXtP31+hDIPKlzK60H73saorA7ieJrzNKro= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=An9K38cC; arc=none smtp.client-ip=209.85.208.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="An9K38cC" Received: by mail-lj1-f176.google.com with SMTP id 38308e7fff4ca-3004028c714so486501fa.2 for ; Fri, 06 Dec 2024 11:00:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511643; x=1734116443; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=An9K38cCeebXwLpU8bCqmEJrBomOqrqLyAEbSNfU5B1LcVFGHGcoTePkagOr9EooU+ ztKAPCweLgsy27AP1Rzz64gf2Iy8pl8uUv+1twRJ2O+gKY+a0jYaHQ++Fn/yBikwAtjM vFuwi5irPwKRVd9L+4pAP2HcCv1J5uwFjkwLEXQVvq5bs1T27WiWPfs6AXPLWDEutQLP SJwpsErk307MnFV/g+wN3GtDb4f3G5h/FUHjfj/Wlqx2v9DifPtQGBCbikm7iIJQX1gw fxGRuw1sAsPHw6Tqq4OiLETw+ewIj4h76o1dUXpdTVxZnUjBVCdCQN6A5Sx5z7LLnbAD d4Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511643; x=1734116443; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=boR/TR+Mbg2nSLIWal5ZKFk/dwozZwg5ECJYFfe6/55hPQ7LFc2Rx1dtaqWtNF0aMI C/8t3OrY+KAbsJ6zE329pROpd976nUirXS0HZsWsV6qHGMYAastwKVcSUwqO2Cxi+7Pm i5jMhxUA7jMGXu237u60QONlU9BwXkWv/q/cT8U2SyoXCZdOE+QEKXATNFEkll/5u8D8 HpOkXJy1pGrVqshd3SO+cSRlnnRAw6/3TZutINI4aHb1xUACvvTIzC20v1oRaCZjvZ1q B/Eqsr9FcyB4vljSUfRJYoVT2mRxZhXm9Wz6JAoFW5GhweODASv8J9v5LILL14IXqP0K fVpA== X-Forwarded-Encrypted: i=1; AJvYcCWPvicM6pdso2QvQfxsd3zEaAmHjXiGjGlfMgzLmxdnVyOliwVCOxepyDYIdaBv0RRGyRR25G8UrmvXjdo=@vger.kernel.org X-Gm-Message-State: AOJu0YwPqC+dU5F5cRuOolxP6YqjoFKHImTl6qZ9a+mPfw/AB/XerqLp 0TS9caprmv4vfiThvXF9/jxOTKORA7LGJlMve8LsiylkqJNSEMVj6Lc8A7R8/yw= X-Gm-Gg: ASbGnctHyb7KvUP6u6U39M5rTly0mordlGpoAaQgIOPoK6ThNriGpbatFsMz3R9EdLD LYU3NAATNDdfcFiTbIFgOcbGL/1p5mmjIPGgy6rZEDeMTbZgnkwxQV9DbWSe0jBk+2ghv2Gs6rb 7TnbbyVBDsQw1b6+AMTBFzNbrZIUBH7LxJkBOwuCFMF1miPrd3E5f2exMEeS0MVTb3wmgbx2HUV /XJHmgL0TPkBEI8qfOcIa3hMCe9wzZZ1HfkHJHn+M/zJKqi6zsDRpfaqlk7Sc2M X-Google-Smtp-Source: AGHT+IEW2UU+jTNoTOcEYuuCfhMKM2BI21VZcY54iVxmn2QTSlWVK53wH/yWJXy8oWjj5yDpAga4hA== X-Received: by 2002:a2e:a98e:0:b0:2ff:8f5f:1adf with SMTP id 38308e7fff4ca-3002f795a90mr13121781fa.5.1733511643070; Fri, 06 Dec 2024 11:00:43 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:42 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 1/4] net: renesas: rswitch: fix possible early skb release Date: Sat, 7 Dec 2024 00:00:12 +0500 Message-Id: <20241206190015.4194153-2-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index b80aa27a7214..32b32aa7e01f 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1681,8 +1681,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; =20 - gq->skbs[gq->cur] =3D skb; - gq->unmap_addrs[gq->cur] =3D dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardwar= e completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D dma_addr_ori= g; =20 /* DT_FSTART should be set at last. So, this is reverse order. */ for (i =3D nr_desc; i-- > 0; ) { --=20 2.39.5 From nobody Wed Dec 17 19:43:39 2025 Received: from mail-lf1-f42.google.com (mail-lf1-f42.google.com [209.85.167.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D9201DFE1E for ; Fri, 6 Dec 2024 19:16:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733512609; cv=none; b=IeU5evrq9r0/67n+6Y3USGVjKscLyKLXHh/GjfkiXHIdjqHxYO83r74hZ9N+B14mfoJ70NmdcXz5+vO4DpK/aA+WobX8KiQ4sYO3NbWjsF61hhCtx0RKlx0t53xEd6revU3Sad8H5ZRBF/j2PXFbVFBprG5ysL3gYZqt+tSAv5w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733512609; c=relaxed/simple; bh=wXdUfPDZdTp7uaCmZH8pm7BfzwNL7Ba4+AgLadvA+oE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=oW+XwlHPkjw7cuc7GrTVfQp/2x6R5Nk3hIO+aKZKE+PRAvlpILVz8Nym64MOJaXdgOqNbdUYaRR2uDw5BGpz3dKR3LALUG5dom6KNDnKutJqgjpyq0A6z0yXu8WibtMqUkobLE16eiUuw2DOUdMwrKLbR54l2KZNe8Tz3j7BjQM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=yeBXnInn; arc=none smtp.client-ip=209.85.167.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="yeBXnInn" Received: by mail-lf1-f42.google.com with SMTP id 2adb3069b0e04-53e22458fb5so2263077e87.1 for ; Fri, 06 Dec 2024 11:16:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733512606; x=1734117406; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=yeBXnInnAHebowSy/6LEyx7rq+2F8MuBDzcc1z9TOClxRX2vm2dhFsm74sRLYze3JY CCvlYdZhyyMpNd3qVz0f4wGnSBuOlg3OiDuSvlfXlKlv3FNFk7A8+5k6CoQwAKLCxLwS BQYgOFOwDp1DISzdf/XpE9OlW8cD6iJsZQtoNj2gPRSeM+iwJJWpbXPb4c40hDK6zI2B thmWBcqLu1ipi0WzMlCWIwReByfskL43prk4aPAjIAjDQlhvM3D71VB7X+qTHUOVO58f 7Xx+SuJlBTv0R9WOmVdIDUTePB7qnTm+R6JuVT+fgTsz438ps68HJZKLOkKPF07eLVK9 k4qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733512606; x=1734117406; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=PJCWOA6sjlgTST8oEgxI3QkNXTQk2zvHV6kMajmV55u6RSjg9g29KPl3JtAt2Q/jrW 2TWkgLVLs3hz28NoUoTWe5qhqwQPrlO+aMhGg6vP4KHTy8cAuvp9/ycaK3ljrYiH0qgp 1XNTj78nc0wL6+TGqaFwmbZQx6Ffj3vuZPlSMiAEnIW0w1TjD0XSgu/kyCij9/tNbEKs 0cUMGQBD/pY8FhvhPtKEwjoZfQIK0k1LVxgRK9Ei1v691UPmzQVJd06wJ92uyhodmJim wZcsJEOC0So0dCrxTfWdBlPOZ5q8YAulC0f8Wol/Tke/9hkTUhJaSxtYcC3oNoqn2oPC GKBw== X-Forwarded-Encrypted: i=1; AJvYcCXeq0AKiOZjHueYeXojb+limQlnZn7OR82w9/fjxgIMD4lOiyqbN3mBM0PJZ0cyDLbZeTvnQ7kzhcWAlaU=@vger.kernel.org X-Gm-Message-State: AOJu0Ywba95N55x/HX4Tzbq+LiOJzeL6LtyOtCiST0wDQQoFHin9EN93 mc7ISYUZ9bzgKiWViRffHxpBY8CFanfbOqcmfCluo38EVjg1H3aPB3snyBqoqy34bxC591fR19F f2lA= X-Gm-Gg: ASbGnctu2XJfVm+RZBnsgw93BipgXWKjtaGJochydtYbjCknn2ZtiEApdqemP5GfvZH Ms31BuoiTd9I3XkVRAbVAO1/ILSmEfGSUjxwBGuY4aZ+WyRUCHJbhoG9U0zFcHc4pFiso2MnsHy XyjXjgS8pS4DQ2QKULyoeE6TwiOiA6tZAVq1mtpy4xr0i0hzW3Aekkb2gXSP2BKKsiApP8fND/l 7cLhwzkDdg8tSsqoSIm+2rnBwAPYUhTzA5X8i8VEW6WWFNE4A822Xlbi0BmV505 X-Google-Smtp-Source: AGHT+IHuzHk6NLkXAtdHOqa5qip3aYMDDKdLV1Lp1l1D6ZrIJKd5dbtyB1JS3gM+1Efv+f3BgNnv7A== X-Received: by 2002:a19:6450:0:b0:53e:3729:eae8 with SMTP id 2adb3069b0e04-53e3729ed4amr728856e87.19.1733512605591; Fri, 06 Dec 2024 11:16:45 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-53e229bae3bsm575973e87.127.2024.12.06.11.16.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:16:45 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sat, 7 Dec 2024 00:16:40 +0500 Message-Id: <20241206191640.1416-1-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Swi= tch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index 32b32aa7e01f..c251becef6f8 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; =20 - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty =3D rswitch_next_queue_index(gq, false, 1)) { - desc =3D &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) !=3D DT_FEMPTY) - break; - + desc =3D &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) =3D=3D DT_FEMPTY) { dma_rmb(); + skb =3D gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] =3D NULL; } + desc->desc.die_dt =3D DT_EEMPTY; + gq->dirty =3D rswitch_next_queue_index(gq, false, 1); + desc =3D &gq->tx_ring[gq->dirty]; } } =20 @@ -1685,6 +1685,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D dma_addr_ori= g; =20 + dma_wmb(); + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i =3D nr_desc; i-- > 0; ) { desc =3D &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1697,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd goto err_unmap; } =20 - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur =3D rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); =20 --=20 2.39.5 From nobody Wed Dec 17 19:43:39 2025 Received: from mail-lj1-f177.google.com (mail-lj1-f177.google.com [209.85.208.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B778B1FFC70 for ; Fri, 6 Dec 2024 19:00:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511648; cv=none; b=M87znW3Z8m/7LxN7NJrPFvZfxDMN01J+XRxxTrqkvINZhF7hgy6AVQa/yBd2GzH+17Hsq9V8WssFw3y3WYZlFWX0f6T3xSZb5a/vx0v7UX3/3rLHF6tUTc7pFanr2aJihHc0pqeRVUqQpvaHlJfU7bqA/mKZINt4B5vGpVfb/Tk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511648; c=relaxed/simple; bh=b5jXhaNolTyyvrbjKKxRcvCAJp8P/hsnV5mqr6x9R1Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Ns1Ei9Qt++upN+uqtdfIuYSyGaKe2niPU/9zHQsgpJeGvO6+rcGpg9mgtyb5AKsv+lbHIag8c2QmbibqNfHM7it98DKq/77iOBxqi+0HDFJZ1AshrgROmffnryrX94TSL0iZy7fGtJouC/8+Ou8IJv8rYJbeSFy3GWzCA7QgwEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=XRyJBV5r; arc=none smtp.client-ip=209.85.208.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="XRyJBV5r" Received: by mail-lj1-f177.google.com with SMTP id 38308e7fff4ca-2ffbf4580cbso26642131fa.2 for ; Fri, 06 Dec 2024 11:00:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511645; x=1734116445; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=U6OmUl/hmI7+OxMAFAfIf+jIYSG9pd6PU033H69utPY=; b=XRyJBV5r5naGO6NKYhqVdJ1aD41SPwRTObnU+SV6/NfOjJDykNY6Bo+ydj5kUjMuZs 0uT5TX16HjBY34lB7Mu6iV0uVeofnX4zfgowjzPQ7SBgZVr2lStVSRXJS7ZVmgFZnZDX 8ScRIS3kTXBtNiGgDsOid1y3nxeQxzC7+P78iHR68t8lRxhjPJJULAx25mMcPydWDIxl du6U3Q4TCqiHEXhaH5wso9j0WXhptPUIlpfuh3wUUNNC0l/csE3RSdth1ARqF2xW3ZwY eB4k2/unOTf/uRrJuIZg/Uxk+7b4NDtFOvnK3hcYyNmwX5djLN9QgmKk4ls/lnWKWD/D 6rKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511645; x=1734116445; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=U6OmUl/hmI7+OxMAFAfIf+jIYSG9pd6PU033H69utPY=; b=j3mMBJlEa6Wi0p247rI29jUJ0SlmDvAYgj1th6K4R4N7XL/gLQR0W/yD6JzomxadZI u9ZBq14AaqaH60oesOQv9E3AnzIWklkSohvw4M4wvQNnha+2tFLhXoC8njXN2don+jh0 8Euj9l2phw7nnz41ic7fPHHHVbO/mdStvxXqQD7CJyV5rnEXPHP+68NJ70MpokxhqREE JF7SpkXo9ohtyGczgDF1b9/HBIU+LKw4mIauXXfP9PJe36Xqa7Nn7RTt0txg/jwvb6VO 5WnRqeHbEDYPoRJjOYlbVprym+LxzI2ONRmLuxtNd540PwKmOLhvSBEJ6xbjqvVkqc5r KIFg== X-Forwarded-Encrypted: i=1; AJvYcCWSheGEn8Ztly2EzwsYA0Sl6ZSUrd14WS3PCnM6aeblCmfasoe6hlhBCzfsUXU5yEfiOxtVkB6CJjwUOvI=@vger.kernel.org X-Gm-Message-State: AOJu0YyC7X5gixy9Co8bghsqVM4KeVZXvEVnyyHp1r+KoUfzhoueMY+3 gIWLd3rPnlim4Uj+e2FOfIgpCYEWNQYbWayuPfglRfyM37Em1x+TElEoeKZb3EI= X-Gm-Gg: ASbGncvSaGLWdlbK1tQlw6nBeAr5i8qD0eNgVgIfEM09KAgNOYJT7+p/ChJvHqJ3qPO c5tH9di0MNjON9WyebsIkckLhonHNLPwrzq2z9yth/BdWeK2t58zz/gOcxyBadoo30bXwh9tU+s 6p5+SsGk3Az53V311FqQBiBnLx4ROymYcYNnwt8Egtq6Um45ZxRPorQIWLSaLfMgtrr2hYR63Y1 nWKqyJHxtHArnKGIBRCdPWm81wNZ2GddI3eGzy+Q8hz/eC29F1UkYhlli/5AFzV X-Google-Smtp-Source: AGHT+IG27wfeYMQbSTxDwOz7Jah13F/6degbx6OGNBuq2fRCCebyOoNgchqtp/MSVdvmUbDhxY2IGg== X-Received: by 2002:a05:651c:1586:b0:300:3e66:5881 with SMTP id 38308e7fff4ca-3003e6658cfmr4086831fa.7.1733511644842; Fri, 06 Dec 2024 11:00:44 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:44 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sat, 7 Dec 2024 00:00:13 +0500 Message-Id: <20241206190015.4194153-3-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index 32b32aa7e01f..800744a6c25b 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; =20 - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty =3D rswitch_next_queue_index(gq, false, 1)) { - desc =3D &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) !=3D DT_FEMPTY) - break; - + desc =3D &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) =3D=3D DT_FEMPTY) { dma_rmb(); + skb =3D gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] =3D NULL; } + desc->desc.die_dt =3D DT_EEMPTY; + gq->dirty =3D rswitch_next_queue_index(gq, false, 1); + desc =3D &gq->tx_ring[gq->dirty]; } } =20 @@ -1685,6 +1685,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D dma_addr_ori= g; =20 + dma_wmb(); /* ensure that hw won't start and complete before + skb pointer was saved */ + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i =3D nr_desc; i-- > 0; ) { desc =3D &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1698,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd goto err_unmap; } =20 - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur =3D rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); =20 --=20 2.39.5 From nobody Wed Dec 17 19:43:39 2025 Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68B6D204572 for ; Fri, 6 Dec 2024 19:00:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511650; cv=none; b=NMJ+cVDmYxO1wjHS3bCqGTDW7D6CzGnj2EZ0FGX2KIXNGuRm6io7J4t3D1wEbW9mqGLyXf6FX1IyBbNaci4hIvn22tFluR0zU2q5DkB/YFmj7ddXubAK1RYw9lBZtCKdmwH+1ygqH6we2Et6hl4u95ZbjAO/G50y3xaRErV0nH8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511650; c=relaxed/simple; bh=KWMNtKFHSXqIJRHh07Fhy/LOB/evmZgba6wRNVyYg70=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=br19pOYnsN1vV0rk/T3irK8gSD8iQTc1/6WyVnjDWAHTRlp08HYgWjoO1zyRvO/Q9hDIrfeXuOxpDjUKSnzkmuJXHcl3pDvRWnhBQN2pyCxlDrPWa/+oSP46+8TlENpqtTyjjmSklS8PuaW6P+VI78E+VGCMWsYsROjy4peYmIc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=AaKeSLfv; arc=none smtp.client-ip=209.85.208.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="AaKeSLfv" Received: by mail-lj1-f179.google.com with SMTP id 38308e7fff4ca-2ffc80318c9so20763351fa.2 for ; Fri, 06 Dec 2024 11:00:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511647; x=1734116447; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=i2QojkySpM8U2FoZ7dctDq5YFcwKebuv3WnOzhKxOok=; b=AaKeSLfvAuYARQhOkn8ve0wlftNC3sC4ypk8JATHhwRbT06adA4sEHbDxd8YS3B28S mghGDaUCR1vHjKf3lrNzzBaG+NCBEScUvZg66xGYtsvT45/np4RPkXpjqEGAAMS10KHz hVg9pkvb7tNwTcXU9fYL07Sas/g9B6ndgGwZa7Oc6fBpOJlhVQrTYfPgu9fLhzqr/0SU 7HNZHM+Otz6zC5l/5D3MMxPhh6o1koCSubufpkIZ6W3Od+as8eM51326nZlXRvmP490p J0gdAQHgQ+6fc9TyfKGllHvk6P1/GJSIa8Oi5OL/gKPPmt5JsmSucpte1FmlZSEtOpED KtyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511647; x=1734116447; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=i2QojkySpM8U2FoZ7dctDq5YFcwKebuv3WnOzhKxOok=; b=rcX14tkKGdRKo+/xyH2YYqM33kLp4RIwVyvs5lcx0+4n+ch8fxiBasCsILwr0OqWko dsobX63FFh60pphQf0rVpRZAChvE+tAzZItDD52+JbFvHK8vw0SjxeF/5smX7o4cP2nv ncqrR6IuKiAI2pAHeFe0VTkLNZ9QuTiDt9DIPyiSa/UKoQDLdX2r2e+npcbXxsaEn0E8 Iz71U4/+Ey9RhJp1UcP/4I/XHBbxE7iTEbBDxRNf+xa5XniWPsWZ1EWRrb3VLbKaoQwZ otTBloNzhVhRb0I38HLklBBFTsUvFABTtUtc59FSdwmG8LSMYFt8aUKErr9udHs3eqLs chRA== X-Forwarded-Encrypted: i=1; AJvYcCXRXAsEognjPMWruU8sXUOJBIZFZw6ibFsFdaArt1YmTg2RUtp/XSYJQiKZdhvgSw/a/WmhRhmYPh/aPIw=@vger.kernel.org X-Gm-Message-State: AOJu0YyY3Vncb7Xjkg9ZFFRJuZipJPTetf/BuMSUJbIkbT9Tx/wn8P1u x46AIpnajTI5pSmGV1jmgYZYb3lXRZZcf8SznYmCk6EEGYGm+mNF8btfST5Phq8= X-Gm-Gg: ASbGncuCbVC2/y2pqpdojQtpj5+zXbhJtDalxYpd1O1NEI93C4P7XsfWdaRUmfdtvuH Ivpa/xnz7cU1noxciUrQPRxr7iSATHb13A+jTGK0L+aNoufNJv0pG3CaiVPd+fsb2iM1k0cdtX+ MTgXHb2RaTaXRgP53NiqIIPbn48jQaxigejpCzfXgyUvsdeAxqruYzCZE/hlkDsQ2TZA6rUNcXf 0StKppsl9aVEBlAXL6BxCPLBY+GH0Pwj48Ly9HMfCOORxmSBnFlyB6eqO0d/QYd X-Google-Smtp-Source: AGHT+IEIsm4wQVX3IM84rN3fxaWi6YpUjvzeeTe6nAk1y92eqqKLDaXUQfpaQtMa2bkKEiL1wi3iHg== X-Received: by 2002:a2e:bd14:0:b0:300:2278:9b1f with SMTP id 38308e7fff4ca-3002fd1b175mr15585421fa.39.1733511646671; Fri, 06 Dec 2024 11:00:46 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:46 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 3/4] net: renesas: rswitch: fix leaked pointer on error path Date: Sat, 7 Dec 2024 00:00:14 +0500 Message-Id: <20241206190015.4194153-4-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If error path is taken while filling descriptor for a frame, skb pointer is left in the entry. Later, on the ring entry reuse, the same entry could be used as a part of a multi-descriptor frame, and skb for that new frame could be stored in a different entry. Then, the stale pointer will reach the completion routine, and passed to the release operation. Fix that by clearing the saved skb pointer at the error path. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index 800744a6c25b..9c55f3480678 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1704,6 +1704,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd return ret; =20 err_unmap: + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D NULL; dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE= ); =20 err_kfree: --=20 2.39.5 From nobody Wed Dec 17 19:43:39 2025 Received: from mail-lj1-f182.google.com (mail-lj1-f182.google.com [209.85.208.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33021206284 for ; Fri, 6 Dec 2024 19:00:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511652; cv=none; b=Vrj78UPKhvHpj8pUaZRLdJHIt3xzWR0vrkayPJNU1n7msY9vDH+qYB7rHYsbECabzSSw1RkpyaKMteJK2HYG06Sa5uWNPa6XRH2HeFyEJD3pkI/GqOF4GqMeY4ZS8SC9ipk9u/5xvED3ro+uY5Aq3uemQ17FpKqVELxqJRQCJqg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733511652; c=relaxed/simple; bh=Oug/7vDlEmuLkveQoKotO5NLIXni795nVP0v+lTs4CA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ULBoVsY7yqjVCrEDmKzNOWVpnIUakjlXz8OKbHSrUTLAUbIVyL702R1EiP6M6yjFFBSDkUbaVp7gvjfDIMzMJT+M5X0ybb8726h7QQ7Hjt0r7cFVPZHPRqP04IqPrQ3JkO8biCzi/ADojccujIPGXaPRTuYNQGQ/YtpZ901ZVDg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=wEASQgyN; arc=none smtp.client-ip=209.85.208.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="wEASQgyN" Received: by mail-lj1-f182.google.com with SMTP id 38308e7fff4ca-30036310158so8157181fa.0 for ; Fri, 06 Dec 2024 11:00:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733511649; x=1734116449; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NRtfoUuaiSmawV3D7PM8LTv0BVbgF0vB56WhOBoL48I=; b=wEASQgyNpo/yZvNu4FM2FZLwukUvTjSW9Bl/iKuQcPUEyujzJw56wyhxTDtFdUu/kU /lDpZCo6Tv9vBIBLp3a6MIMjWtKYOedZ0lZygTAd3er8IydxKPS1zFfxHt677LsEHc2l vmj0Ohc9O5PRfkUwsOuysxr4H9agwqA+gSZ6N71jKXXvG6ELdBDxcPk6bwywUU9mi3TA jHK8MWGV77x6IsOVrvr8YmC4yf1jG3qJejXX85VXlwMwRS6KsEi5oqXZ2yCP0xag1Ird +ilT8UGBC0IAAZiLtx0obj/EjinkLj6nEmxwhTNJ0SYq+EJNJUzP3508gILz+DOydElq i3Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733511649; x=1734116449; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NRtfoUuaiSmawV3D7PM8LTv0BVbgF0vB56WhOBoL48I=; b=Pgt7sh+81hWRhme+7KmOQSa1BgrcpOeJ11vwrhdcwheSjsbm8QbXtC70oM+YfLfxcE PBFoPEj6fYCRrUDM7Sr/UfAyEQabKUmqKcc0Q7/mAmwArpBCXE9+FtzTiuGAnFS1hwZk yhrN/YqTk+n9nQLKdhceZCtVQZDZoyVC+fRw8nU+kXaSLqudIFb3FLJtuAsMcfzOQrAI 3tFepSW6RN2/AQMx+Sm5e/ub7OCx4lf5bB9Ud1s2NlwzFyrI0wCV0pcrDcPWopzORhsn dYiSvdjlImqHP4ft094XxMJOh+JP+iLND/VzaUtt0AZrzGVGHK5e7OO+LMQ2dZQ3C1S7 xWiw== X-Forwarded-Encrypted: i=1; AJvYcCXSNnOR/8Exhi7zHDpSMRmARW031XSexfuYQruVUFpdHhgtR7XYpdB3CBLK6UHqJEP7E1qNJhLm9Gf9Z5E=@vger.kernel.org X-Gm-Message-State: AOJu0Yzi46Ul9kKnDEpo4s98EC2Iw3+2/OfdL4Fe4EvhaVC5qVv0B2YP WiJ602dsn8wt/QKVGNIzTAdnyGrR7pfcM3OYRtbAK4nCUGRG92C7uTQ6XTasCyE= X-Gm-Gg: ASbGnctGqjP/pZTbF/ND4iw/MvfpAuktHK77kMTc5n5Boxx8c/riyvMjATRrxG9nOSb capw+3FKqJg0Xr9vw5AjDqUJxIsKy+fQdaT9aAUsrATDHYSEJ/doyxtgz/4OHknMyZVOLxl62g9 UrEml1LSX6eGCcyLA5tvgumq6IiNLGBUrRcv2FqUM0/qSVHR4Ixaf3qKkzx1dD4gjRLbLI8dFDW HW1x/apsY2aCK28xzBWX89EfxraeLIh7m3phwcMHh/Zp13NuKiVSRN9c9w549nj X-Google-Smtp-Source: AGHT+IHHUgZX1u6gj5ZZhnbZvFvdFxtWjem7qzmC9NdGd/PDARE/4bpEVRG4Dg3PrMiq11s8UCNfVg== X-Received: by 2002:a2e:b88c:0:b0:300:3a15:8f26 with SMTP id 38308e7fff4ca-3003a1592e3mr14869321fa.0.1733511648446; Fri, 06 Dec 2024 11:00:48 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30020e58200sm5523201fa.113.2024.12.06.11.00.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2024 11:00:48 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 4/4] net: renesas: rswitch: avoid use-after-put for a device tree node Date: Sat, 7 Dec 2024 00:00:15 +0500 Message-Id: <20241206190015.4194153-5-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> References: <20241206190015.4194153-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling= ") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index 9c55f3480678..57cf211ac1e1 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1892,7 +1892,6 @@ static int rswitch_device_alloc(struct rswitch_privat= e *priv, unsigned int index rdev->np_port =3D rswitch_get_port_node(rdev); rdev->disabled =3D !rdev->np_port; err =3D of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1922,6 +1921,7 @@ static int rswitch_device_alloc(struct rswitch_privat= e *priv, unsigned int index =20 out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); =20 @@ -1935,6 +1935,7 @@ static void rswitch_device_free(struct rswitch_privat= e *priv, unsigned int index =20 rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); } --=20 2.39.5