From nobody Wed Dec 17 17:45:11 2025 Received: from mail-lj1-f172.google.com (mail-lj1-f172.google.com [209.85.208.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C31113A258 for ; Sun, 8 Dec 2024 09:50:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651415; cv=none; b=g6+0pm+IlzIrcI1Zqz+orRV7TeWPwVgWpYflRYr9UrFufio/VfgsHk7AbRu2K/3sp9lG/wM9HgccDF5+y7qivoa9vYKTzDUQOw5fkcsJ2RVsjGHg7MMErF2UrU8tgfRvs4F47oBFYisTB8181ich9e1FTpWx3nQQLGGnqaTyGw0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651415; c=relaxed/simple; bh=SI27lQ6ouPyc6VSvj6mijRBvLjbpSdfHHV2X5cxHAlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=MmXVwE2ZEf6NIfcKN3BJ2g+obLp+jzebcKXVT4oSFTrcvJF/Pj0XvJ/q9moCb/nbmH5asdB+13ke0LQqoxJcerd/T/cT0c4P4GSbmSMCnnpg0WP6aCRp3FLHsRJF7BOMqpe1aqTpDmSpVSvKa2DfNG5SfDaFP5jM56A7j86T+UA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=qJwWDtA8; arc=none smtp.client-ip=209.85.208.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="qJwWDtA8" Received: by mail-lj1-f172.google.com with SMTP id 38308e7fff4ca-3003c0c43c0so14637491fa.1 for ; Sun, 08 Dec 2024 01:50:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651412; x=1734256212; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=qJwWDtA8HYNQUxBJnk5UQAwTob5KH7pl9B6Ae1iyRzoO/77/FJsXTu9ch/SrstK+wl YL1AEeug/zISOaQddiI2/m0qDpX+tiAo7chTJRhzLKKx0LYBIbTIexPJELJ5onZ6aOnk GTYW3mu4Dwnz73cDbodVXNHQaQYh5Zvw3gOZCnnsVmqeJw1D5yAj/g2p8sUPcX0C1l8c GgW8bQx2xYQqT/6ix2CLR8nAvNYrQw7TvihpnwEkdKRAefcK5Z4ohY5kbgXRSs5Mrs80 bdN39B/e2cCwhUGOjb1I9w5ZuJVNMsttzqIe7Dh7qJkZDIRWOfLvNvj9gRPwGcmCaJOr XiYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651412; x=1734256212; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cynV8pOJrKJvNaQFqaJO/JMUBstzgBuJjjWcaNQed4I=; b=e3MGKvtY4Jv/iB2FiCJgzae8U+wEszblgyu5NnBVAv/YrDTQvA55em3xP98XN03cl3 FMLq6jMtHxFokSwoAPTSZE+jY16YNmzunSR8XTmoEhq/rc2I3kDU8JN2Si23FNqSNOJ0 jC6k20iDNMTyhwguBKFZaAXsQXRXGK1vxnXnaIw7cSk7v4FE8odNNUsdea3HY1sV164d 0RPiHU48SL9JOgB0aGtHgvmg3PPf8A/n88gjn64CTw3Lnob4TXDmjvZirH596u8/dwsm HSEkYPE/L9ZNbfKleB85AXtB5RoiCMvQGJ3Ki4bvBSpWsCgkHWBOUBJLnsOsGZf/0tt6 14UA== X-Forwarded-Encrypted: i=1; AJvYcCV+f/XYiCvaF/5wuFppJ3kjPCEx4PkKv/JdT7y2E4/lF5hVnjFWK+E0oZq+0Vouvdw2tCHgJdN9R/8gYQg=@vger.kernel.org X-Gm-Message-State: AOJu0YzQXUOhlcn8saKf1iWu0XJvEAXw2qWuH7T+H1+UtMHgd/Fdo6IP g5+0hwZUXNThcjtt2K/hJkaES60rw36tan3EWgUZvLInEhFZ7NAO2bA03gezKEDWs9WhMDVtbkl pi7s= X-Gm-Gg: ASbGncvMG9N2DsoJqu0atiFASBs1lkW8LEg48M6e/8rfBuhTFszh5sb3KVQcJcpX2KO 7BXNdg/y+pPlMDTB8SGa2dtalupPy3uE7YhZak8jWwW7Un72uBZPxuk3E2LdZgRT+dpq3vuo6WR fDkrG3is5I8+ZPl2sf2oaNVq1HVdnKj+OEVVoU6SP6kgOoQLSLCjqiSbGz/R/nWh8mJOTEMRszQ INB6ZviD2ah6m9wlpWiIK1QcNOdTYlP9mHBNWmfN0ku23wtyEsZrRlSHWctet4z X-Google-Smtp-Source: AGHT+IGmOlhACGEiwReXdOmA2tPXqwQWewjxb6Ay7meV1g237ucqsf808iRNKjO6hZpq9iuPGcdG5g== X-Received: by 2002:a05:651c:1586:b0:300:3e66:5881 with SMTP id 38308e7fff4ca-3003e6658cfmr17033281fa.7.1733651411640; Sun, 08 Dec 2024 01:50:11 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:11 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 1/4] net: renesas: rswitch: fix possible early skb release Date: Sun, 8 Dec 2024 14:50:01 +0500 Message-Id: <20241208095004.69468-2-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index b80aa27a7214..32b32aa7e01f 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1681,8 +1681,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; =20 - gq->skbs[gq->cur] =3D skb; - gq->unmap_addrs[gq->cur] =3D dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardwar= e completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D dma_addr_ori= g; =20 /* DT_FSTART should be set at last. So, this is reverse order. */ for (i =3D nr_desc; i-- > 0; ) { --=20 2.39.5 From nobody Wed Dec 17 17:45:11 2025 Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 297271448C7 for ; Sun, 8 Dec 2024 09:50:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651417; cv=none; b=MQZgs5V5UWdqR6yZdFQHm9DxcswFX0h2sbhTxbA9NkKL/riRpK5LI2G1uiIFeW7d/iV+O2VKVmAZhKellfdiJpl9ODtvwh6sWbcDy35QE3VxJvFAvRbZRFYzgYFv/LYLLj0/4XhFsZP0pmUMaLYbYUABkbomTXbpXg8qmjtRcdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651417; c=relaxed/simple; bh=wXdUfPDZdTp7uaCmZH8pm7BfzwNL7Ba4+AgLadvA+oE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jsXAMvV+EmUtd8EZ0+UZ4EDYtEzTW26OubPH/+Z6Uh96PoPfYeaLP3VahisG3dAALfX9+1ERI0bHcXeD8gKabwDtanEbzoBG0U6JQ1aEVPODkOpWYL3Ck9Ie0MKB0v2xvTIe8BkCnre+mjOTld1EQupgb7KdwK0Rdj6qPhzYU+I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=VOyNYOcq; arc=none smtp.client-ip=209.85.208.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="VOyNYOcq" Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-2ffc86948dcso34126781fa.2 for ; Sun, 08 Dec 2024 01:50:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651413; x=1734256213; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=VOyNYOcqXtcI3aCNYRedaRVcOaFPSgTgnsDW1JqQD3s/C/3NnzJwJVPCd1TkgATPzf nt4UwqQWzNDhbwqL3TWfYdICpAb/b2LY+DRvtVlNMAHcaqIjDhwVpc7j/tbuc4czCv7U Ju0b31JTSxN7K0l5o/5yspnzzyTYRfYouZLvaKDTAEqJZQyvhtcUJd/Cyq2Jwr7w7JdZ K16SFeY0qMdvJ0LH/WDSbPaZZIzp7svCNisKyU1yOm0oCWdyHMX4wLR8FQSDCusp3hHe v6pqZ0kbObYDI3a483+JP6zgGJo/DbQ7ztkoD7CrKDTTBsccasIyC554v85uBUGeQzGe /8sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651413; x=1734256213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4qJbTipl5jmcN+zl+yZ2AXjrvMRunb990PfhdGFi+FM=; b=QXw1gcBTCAARYDUh+ixeb1iLKHieIxuKDhuJahUw7XkJkuhlpsU/06LSUj1ifjpr1O gvwiK3z8r7jdH9DLx0FTgFalxwZyDaZD8rgzEbwtOsSiHH79I4UOaE3CvVPbp2U8rLbF Eky51GXTqw7+Ts1SXzhQgEZKkdo3sUDGXyjfcilYJy+iA7J+TGKPkYYuUNs7Qgx2Q8YC m9BFn+fu7Wn81Wc+RF3RHu6w63HG6mjnzlcxN530DX13Te7fHsFaxqlV46cI8g6SKcf8 Qxhuz91EiiSNUWj250Vf7O5LWRZDjWE9HPsOd91Wlvdj2R11qy8RhL69ZTnPvcBXrRQq Hhig== X-Forwarded-Encrypted: i=1; AJvYcCUNCa111eF/wKOesS0qrNTwPsnKrLiCyHijojNCMsRkseLUhoHD77Z7/YYcGUg6J4GS021yTo1/in/h46I=@vger.kernel.org X-Gm-Message-State: AOJu0YxmzWZOd5jqT17gGyF78FEolBK9p00lrVu/mMxN2w/qSbJNXSHU h+r+s5Hwy8HmiF2cmZxTpahUfDBciYqso5CJQ67gCr880TwwGipatldA1PkAMVg= X-Gm-Gg: ASbGncsSLgsY9g2vab6zFFDzrc3is7+oxwHXF6K6y/TudEIIQjdVvH8XjQ+pZaGbUIo SS4k1XBcdybTKZzVmb8UAbA9DwwdvCW1UnzCbXbBpICnK6nUpSQhb3ydaMYPh/cM8aSMGYmHYTL f3AZRxP+biNw0i0928zcjQxJbHS7wA/E9ppYe+3DQdwqNQbY/urVeOvHins98adQHylItY0m5Ae KivpoBBqk0/z6Zd55ACwTIlDE+rqk8R/TeIO/mvhp6LBJJfndMq/jbU7KHBmgzJ X-Google-Smtp-Source: AGHT+IHjfkWlUO9ktjjTWDVzSSef25MV2HxBTpd82UrqbQLyW1H2AFrdbCeLYV2NDHOM5jBn6C1seA== X-Received: by 2002:a2e:bccb:0:b0:2ff:55f0:ae4b with SMTP id 38308e7fff4ca-3002fc2585amr46517131fa.21.1733651413281; Sun, 08 Dec 2024 01:50:13 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:13 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 2/4] net: renesas: rswitch: fix race window between tx start and complete Date: Sun, 8 Dec 2024 14:50:02 +0500 Message-Id: <20241208095004.69468-3-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If hardware is already transmitting, it can start handling the descriptor being written to immediately after it observes updated DT field, before the queue is kicked by a write to GWTRC. If the start_xmit() execution is preempted at unfortunate moment, this transmission can complete, and interrupt handled, before gq->cur gets updated. With the current implementation of completion, this will cause the last entry not completed. Fix that by changing completion loop to check DT values directly, instead of depending on gq->cur. Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Swi= tch"") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index 32b32aa7e01f..c251becef6f8 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -862,13 +862,10 @@ static void rswitch_tx_free(struct net_device *ndev) struct rswitch_ext_desc *desc; struct sk_buff *skb; =20 - for (; rswitch_get_num_cur_queues(gq) > 0; - gq->dirty =3D rswitch_next_queue_index(gq, false, 1)) { - desc =3D &gq->tx_ring[gq->dirty]; - if ((desc->desc.die_dt & DT_MASK) !=3D DT_FEMPTY) - break; - + desc =3D &gq->tx_ring[gq->dirty]; + while ((desc->desc.die_dt & DT_MASK) =3D=3D DT_FEMPTY) { dma_rmb(); + skb =3D gq->skbs[gq->dirty]; if (skb) { rdev->ndev->stats.tx_packets++; @@ -879,7 +876,10 @@ static void rswitch_tx_free(struct net_device *ndev) dev_kfree_skb_any(gq->skbs[gq->dirty]); gq->skbs[gq->dirty] =3D NULL; } + desc->desc.die_dt =3D DT_EEMPTY; + gq->dirty =3D rswitch_next_queue_index(gq, false, 1); + desc =3D &gq->tx_ring[gq->dirty]; } } =20 @@ -1685,6 +1685,8 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D skb; gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D dma_addr_ori= g; =20 + dma_wmb(); + /* DT_FSTART should be set at last. So, this is reverse order. */ for (i =3D nr_desc; i-- > 0; ) { desc =3D &gq->tx_ring[rswitch_next_queue_index(gq, true, i)]; @@ -1695,8 +1697,6 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd goto err_unmap; } =20 - wmb(); /* gq->cur must be incremented after die_dt was set */ - gq->cur =3D rswitch_next_queue_index(gq, true, nr_desc); rswitch_modify(rdev->addr, GWTRC(gq->index), 0, BIT(gq->index % 32)); =20 --=20 2.39.5 From nobody Wed Dec 17 17:45:11 2025 Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8FC0147C91 for ; Sun, 8 Dec 2024 09:50:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651418; cv=none; b=aEA0Kcdb44j3xaxpMkLO76utoZWU8JclCU0NxpDUY049g0M8JJpyeuGb9yGR/OSLx6JYycM4ULvQdbonlK5uEY1FOE7p0ltOdbzbKc9qBaORm41EqB87mC7ctj0u1T0I7y7BmUVd4frhZCgHeT+G1OHRIBGsOVN8Y9/0xUSoRFY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651418; c=relaxed/simple; bh=K2M2L/ZAYcnrWJuH8IzCe8Rtu47EQV2npWezrC5CH+Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PN3NqcyUynjEsidC8dqIVeqoeftd8V4rzMvaLVSZWNWW4DC9ANIeLqX6p9dTzO/UW4HT2otdW0QENUgoba5xgM2uRfLrHV5EDsRMDlvoyCah9cW8Xw0xWZDz3YCX1S6TFpddxO5hnw6bdhUtQJsOwdn24IhtBF/enXaSLWcZBmE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=sPCwhCBd; arc=none smtp.client-ip=209.85.208.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="sPCwhCBd" Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-2ffc76368c6so32322691fa.0 for ; Sun, 08 Dec 2024 01:50:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651415; x=1734256215; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=UJZ/cFgyayhBFYtEHeJoPJb1EWnv+22CKraiiow1EcU=; b=sPCwhCBdc6YMouvWYQ8hlPL3wknNBTqsfqp9NwAgaK4KIJ1VwbGcdu4fBlrTxG4z/z fGcVGMYcjb5364NRPfSkbz5+NGH2dMugSZ+Wctq0DV6IEZnH9zZD4ke5b6YllYRVUXuh ErUqENNfOBpO7MuuLuUMVE9Js0gVdeDL5xd05lnxsrhneTCzWFHo6to+ah6NjlT0f2f1 L5uzKOaA0qc5g5uB0yU1lUG4dnIEY9SOBj1G4lZdL6z4VWaGpuFL4vwchdcNPlMnyLsP jLUJg2TyiR2ByUOgq8wczKAqPzjtXhwJc/xXrbrb7eYm1Ab0bTM6vT3b6YSQR2BGgAUh LFTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651415; x=1734256215; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UJZ/cFgyayhBFYtEHeJoPJb1EWnv+22CKraiiow1EcU=; b=bHvhj7m/C0nlfe27EI7TGlQcRXHmcy+fMHRDLK4ndug1KYkTNSTz6AIcnE54aL/PQG 4ptWlvkdcSBipWzFIJmXZlDWuOlZs7oG5FNqbhCXssm6H+AsfheylJCOefbhxb/TFpqS 1YPJMNUkONRQWd5ou8uqDzFtQ9jHjifIFF36CdSr/Njbojbaxan5rJk7ReleFTYzKH1t t1YCVWcK9on7Iac4bCI75aAqpC2qKfrlmE+3kq+y3BGRX6hAzV1vW3+CZ8kXisNV2x5v XXuagkStXWMCXZvdG4hROtCOqotDMZy8d+tR9cBah0izhQgnWmNSCCLE0HRlH+7hqZqG KdsQ== X-Forwarded-Encrypted: i=1; AJvYcCXdZh/iF9syYJtDUFkeDOCILjXm0cFF++JQPiAYb7KzYxjJw48zZmxl+WQ8uMmtgp54rnDVPVey/G33OvA=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+aMasgItY/5iH1RSorj4Yq7gFxM0woRsSGWVJ4M8s++Xd5TLl 5c6Y/j+1F2zsna6VVnWP+ncvBq5xHOqkpwFqiWXP8wQCIS3hnwxkps0JZrqgF8s= X-Gm-Gg: ASbGncs2vqtcTVhBv/15RaVjPdo5nkkTT+9Pm7YEL2xkNod2L3nkSoee+f8db/6ipKy Wj15e//FygpZzVjFpSkbtM4MO6KL/QBHbxoja1ax8GZ/+tDWbsLgsFBB7/8VxMoS80uizk4K9HL 2b2vnulm3tLUijAxl0zH3rwGEesQjH5FEglTmXLuYvEQL2AVtQKtvITZhuxyvy5Og+4rO1v/+1V C11yDXeNYqWIjBQCq2gylYBd7JbnJXSWZswNchJz8eWoiXTMZqu3LfCLnkuKgyp X-Google-Smtp-Source: AGHT+IEg2JUCxfsh/bJ+hiKC7kKcxPI03So5n7bJFcOp4QMs6n7AD95qHIYMZq9Fveaz33U6ohLDAg== X-Received: by 2002:a2e:b88e:0:b0:302:1d24:8db9 with SMTP id 38308e7fff4ca-3021d249048mr4578011fa.20.1733651414953; Sun, 08 Dec 2024 01:50:14 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:14 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 3/4] net: renesas: rswitch: fix leaked pointer on error path Date: Sun, 8 Dec 2024 14:50:03 +0500 Message-Id: <20241208095004.69468-4-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If error path is taken while filling descriptor for a frame, skb pointer is left in the entry. Later, on the ring entry reuse, the same entry could be used as a part of a multi-descriptor frame, and skb for that new frame could be stored in a different entry. Then, the stale pointer will reach the completion routine, and passed to the release operation. Fix that by clearing the saved skb pointer at the error path. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index c251becef6f8..af0bc95ad6ae 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1703,6 +1703,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff = *skb, struct net_device *nd return ret; =20 err_unmap: + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] =3D NULL; dma_unmap_single(ndev->dev.parent, dma_addr_orig, skb->len, DMA_TO_DEVICE= ); =20 err_kfree: --=20 2.39.5 From nobody Wed Dec 17 17:45:11 2025 Received: from mail-lj1-f182.google.com (mail-lj1-f182.google.com [209.85.208.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 757A114A0B9 for ; Sun, 8 Dec 2024 09:50:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651420; cv=none; b=Rqs6CAndFho6EUN3YfuKUtwTe/VoT3yCGz0+XPOGeYFm32VwRBrxV/E5w2EprfYL8H/rUmyYwY4vWQVfDHaY/BgRO5uQ5KlbczMrBW6EB4KoI1phbvbj09SvEj0rIOI/vUYv3TunoZP7blWu2L9Y2kjsIlf3MxgKYjOO8zov1W0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733651420; c=relaxed/simple; bh=m3xLhEgvkVumCBPK7rvot6sHsRzw5hUEzzHNk/EM1Jw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=o8i9z9+O5E9KIaJdJ+qbLlhqhJH8N3NOQX6yAAE2/dARu3Dg79Wr4KltENwJx0heEPLVeY7GOQ2mcbpq9v38QUxOME2cktxpgBH41pNJL3w03RGFlKaUs/GChk+CTZOabPfwbvkQeRSND224MeXONdI7rrnlmhzsu4xnUm0zZIU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com; spf=pass smtp.mailfrom=cogentembedded.com; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b=EnLovTV1; arc=none smtp.client-ip=209.85.208.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cogentembedded.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cogentembedded-com.20230601.gappssmtp.com header.i=@cogentembedded-com.20230601.gappssmtp.com header.b="EnLovTV1" Received: by mail-lj1-f182.google.com with SMTP id 38308e7fff4ca-30024c73101so28609751fa.1 for ; Sun, 08 Dec 2024 01:50:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cogentembedded-com.20230601.gappssmtp.com; s=20230601; t=1733651417; x=1734256217; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qi9ee4q7wG9Z60y8ibg5HDfGF5CuB96sJUYWCS5oeVQ=; b=EnLovTV1hVXNz3iGbnvlrJwcGiUA+4QEgF7a76lEXrH0MowfFGGmST3lT+Vg9EZEOI M1AdhvjdWrGkXFqF6XebsOe2aU5z1oYHI8PSVanWWqGRXiSbET4iKKLOehkkytNN86QX cz3lC87U3WqQDd+aMkjr4EUW39ddEYS2EPt79n9xdRkSBCcsxmvNrEjosq6uyv2nMan4 j1CwFmcwBvOyK9oU3If5pwoLQKjofhhFWjTJXpGt12v9dKBRh245PaLq4uyCDRADzJtm Dmb+cWLBHAMkGd+eJNRyW/pO1KUagLh3vtJFjS0S30UXIACZqSE/GgG5s0TpCdvM4jSz elXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733651417; x=1734256217; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qi9ee4q7wG9Z60y8ibg5HDfGF5CuB96sJUYWCS5oeVQ=; b=LAVtLqEAdAZm+6lY9dqz1pzpGBP7/bPgcBRv+qgKoFtIGQGdaF5oMmVe0HBJBSs2/9 2hXeVM3ZH+ZYzpcUontxBuym0yuDhMEOpSOmbU9um2tKdTWSbTQbx2rLdU11lKwlYPWo JaIos30K+F04cDdOjqHnBFXRcu+0q2KITZ8cmFPTaCJqftxMiMu14Q64wxTvSGydYpHS 7/c7tHpgpisi+VIiiJnzXtlp1Szh2vL8mL1MtjBzFFbzXTIokLQxKctaKUJ8ZeU8BPz8 xPjNEKudfjpogsB6RVM3tQF0KDdgKBp8aQZkP/ZyyGSM4ILTmBTagQFaxwKdJH23Wvbg RL7Q== X-Forwarded-Encrypted: i=1; AJvYcCVpDmzyxe1q3usvnKXCZIKnrJtAyOQor/s2Ngbkfcm2M18+AMLJaPGexrKtEWq/nwuOzXOFZtNjsCl+Gbc=@vger.kernel.org X-Gm-Message-State: AOJu0YyWKbX5RLNbmPqYRNWowdX7qp/kyzBFi9neiO3MQejsVIbzdNhi 6Zct4ChmTBqN7Xg8oxgDLAtdSoeydSrqtT2eL+1NSbrXp4PllFfq8GS+D3WdO9M= X-Gm-Gg: ASbGnctVTBd/7n8EHD3sI3I49U+a1M1cT68mjTp3CWaNEIoOKrcfomejGBmOMAEV/bk EnpDCAaCEVM6A9KQRTzgNQZQ+Y7RZx5A4ZUKC35IcSpf0ixLhye6p2P+j8StZoIKx7VkfZpgUFM BIt/xLF3r2BUMw/tp4dB1Xq6Dvwc/3udj8HjVWtmyLJ2jFfQ/JYJuEEcRSUKYuTRvNwbayo6ElR byKeIERZyp7Q5spaIZQYHxEXmUOKCXgPzE60G+XsaaxEs7K8qbriFp7dUpeAgfi X-Google-Smtp-Source: AGHT+IGMZmYJjHnUsc238RV3yY9xHt3nqaPN8mYEXiS21C8jUq0UJbg1npLyXNDZJfghXQMbM8fRmg== X-Received: by 2002:a2e:a10e:0:b0:300:11e4:ce2d with SMTP id 38308e7fff4ca-3002deff095mr31481261fa.20.1733651416628; Sun, 08 Dec 2024 01:50:16 -0800 (PST) Received: from cobook.home ([91.198.101.25]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-30031b80e7fsm6645311fa.120.2024.12.08.01.50.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Dec 2024 01:50:16 -0800 (PST) From: Nikita Yushchenko To: Yoshihiro Shimoda , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Geert Uytterhoeven Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Dege , Christian Mardmoeller , Dennis Ostermann , Nikita Yushchenko Subject: [PATCH net v2 resend 4/4] net: renesas: rswitch: avoid use-after-put for a device tree node Date: Sun, 8 Dec 2024 14:50:04 +0500 Message-Id: <20241208095004.69468-5-nikita.yoush@cogentembedded.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> References: <20241208095004.69468-1-nikita.yoush@cogentembedded.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling= ") Signed-off-by: Nikita Yushchenko --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/= renesas/rswitch.c index af0bc95ad6ae..3b57abada200 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1891,7 +1891,6 @@ static int rswitch_device_alloc(struct rswitch_privat= e *priv, unsigned int index rdev->np_port =3D rswitch_get_port_node(rdev); rdev->disabled =3D !rdev->np_port; err =3D of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1921,6 +1920,7 @@ static int rswitch_device_alloc(struct rswitch_privat= e *priv, unsigned int index =20 out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); =20 @@ -1934,6 +1934,7 @@ static void rswitch_device_free(struct rswitch_privat= e *priv, unsigned int index =20 rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); } --=20 2.39.5