From nobody Sat Jul 25 17:33:46 2026 Received: from mailout1.w1.samsung.com (mailout1.w1.samsung.com [210.118.77.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 551FB3C73D9 for ; Wed, 15 Jul 2026 12:36:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=210.118.77.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784118976; cv=none; b=P3D2QIor6FLC/EIyp1Oypec3oBWid+zMMe73LVZsZeKUd/NJxP5NuxKVx655OITWmmR+enEyqbRyCLiQHzaba3bZHPMHX4r85v7RRdfnqC//KmlQAtUtX/8H1akXRUiOl4By9MDz+hS74NaEtAk1vWlts+1XdOw1fB592pCam20= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784118976; c=relaxed/simple; bh=GHfONwn/bpfIhneQDq32RP98AToMZwhpL+MQfz4dijQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:MIME-Version: Content-Type:References; b=Wh25aC2y53R1ok1zY3vgiIM50gyCTn/i7OmxY0kr3Dt/mmEz7S1BgVk4PfIEqfSozJekoZo/1Ez42ZQQfCZjvsFh4f8+298CJF3hkLhtseugS1OQ2BQTvUEhaxotpgZtgxszyRdT/0SPE/5pkArbhLQfuT45LY6ebJxMuDIUc6w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com; spf=pass smtp.mailfrom=samsung.com; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b=Y4ARRXf+; arc=none smtp.client-ip=210.118.77.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samsung.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b="Y4ARRXf+" Received: from eucas1p1.samsung.com (unknown [182.198.249.206]) by mailout1.w1.samsung.com (KnoxPortal) with ESMTP id 20260715123610euoutp01398bf030008f3624c4934f3b13172181~CdsBU0LQg1870818708euoutp01e for ; Wed, 15 Jul 2026 12:36:10 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout1.w1.samsung.com 20260715123610euoutp01398bf030008f3624c4934f3b13172181~CdsBU0LQg1870818708euoutp01e DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1784118970; bh=2uqhzatz7NlDzESa9PUCo71vFC+Z9fG5K7FS6DttHiE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y4ARRXf+GJzKGZmQz/G4oNqh5JkkL7uNFvoP1xvXPakuG7t4JlO9N7i28B/CBApxa T3Pi87yI62z7VgVz3nhjeP6v2RCcSHYqgAnHCrNdmGirXS+pLbMzELO5hztd9w0scK yAqWDfpmk0OfP5Htde2dMJvlwdtpPSXXRmYwFuZ0= Received: from eusmtip2.samsung.com (unknown [203.254.199.222]) by eucas1p1.samsung.com (KnoxPortal) with ESMTPA id 20260715123610eucas1p100ea97629de7a87fa67016275cfb38f4~CdsAwxlzu0260302603eucas1p1Y; Wed, 15 Jul 2026 12:36:10 +0000 (GMT) Received: from AMDC4843.eu.corp.samsungelectronics.net (unknown [106.120.77.61]) by eusmtip2.samsung.com (KnoxPortal) with ESMTPA id 20260715123609eusmtip2ed2c8310254681e147758f83b064e203~CdsARqFta0361003610eusmtip2C; Wed, 15 Jul 2026 12:36:09 +0000 (GMT) From: Jakub Raczynski To: netdev@vger.kernel.org Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, mcoquelin.stm32@gmail.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Jakub Raczynski Subject: [PATCH net v3 1/2] net/stmmac: Set Rx queue page_pool to NULL when freeing DMA resources Date: Wed, 15 Jul 2026 14:36:01 +0200 Message-Id: <20260715123602.51950-2-j.raczynski@samsung.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260715123602.51950-1-j.raczynski@samsung.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CMS-MailID: 20260715123610eucas1p100ea97629de7a87fa67016275cfb38f4 X-Msg-Generator: CA Content-Type: text/plain; charset="utf-8" X-RootMTR: 20260715123610eucas1p100ea97629de7a87fa67016275cfb38f4 X-EPHeader: CA X-CMS-RootMailID: 20260715123610eucas1p100ea97629de7a87fa67016275cfb38f4 References: <20260715123602.51950-1-j.raczynski@samsung.com> When freeing RX descriptor resources, there is standard clearing of descriptor page_pool via page_pool_destroy() which does destroy page but does not set its pointer to NULL, which must be done by driver calling this function. It is not done in __free_dma_rx_desc_resources() when stopping interface, which is generally not an issue, because __alloc_dma_rx_desc_resources() do= es setup this regardless of previous state. But above is true assuming reinitialization is successful. In case of failure of page_pool_create() in __alloc_dma_rx_desc_resources(), all non-NULL pages will be freed, including those already cleared. So there is possible kernel panic due to wrong paging request at address. Fix this by assigning NULL to page_pool pointer on free. Also remove NULL check as page_pool_destroy() does check for NULL param. Fixes: da5ec7f22a0f1 ("net: stmmac: refactor stmmac_init_rx_buffers for stm= mac_reinit_rx_buffers") Signed-off-by: Yashwant Varur Signed-off-by: Jakub Raczynski Reviewed-by: Maxime Chevallier Reviewed-by: Mina Almasry --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/ne= t/ethernet/stmicro/stmmac/stmmac_main.c index 2a0d7eff88d3..3098971e0b66 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -2172,8 +2172,8 @@ static void __free_dma_rx_desc_resources(struct stmma= c_priv *priv, xdp_rxq_info_unreg(&rx_q->xdp_rxq); =20 kfree(rx_q->buf_pool); - if (rx_q->page_pool) - page_pool_destroy(rx_q->page_pool); + page_pool_destroy(rx_q->page_pool); + rx_q->page_pool =3D NULL; } =20 static void free_dma_rx_desc_resources(struct stmmac_priv *priv, --=20 2.34.1 From nobody Sat Jul 25 17:33:46 2026 Received: from mailout1.w1.samsung.com (mailout1.w1.samsung.com [210.118.77.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDFF143031A for ; Wed, 15 Jul 2026 12:36:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=210.118.77.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784118975; cv=none; b=o4EqKUYNylOhOmpoXDjmca30TE0ZdfF2t9mQI8k+Wwfjc4zIIL19KE1L841hB7CUaglHyyU5qC/FfOwZzvbdekKw7VQnCRummQJp0+ge9LRNb3rVTinpHxWjapJSiEYaJwX4AgHLcLvCByV4SGQqU0wx3g1Dto8ph/3Diqto1vs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784118975; c=relaxed/simple; bh=vEsiKMGdx5Ffi6xHHnP8FyY/HHOQPO+iDK0oie/ay+k=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:MIME-Version: Content-Type:References; b=ZztfbDv/4FYLlKWq0RbKWMgF0frdccxPgVmgzXDeOnV6hIlWpD2rVrYLFSlhRXIwIV86JjodX9Atwf0zGrxepW0EKmqm3pP5tX4628EM5eTeX8+DwTf3dbcH3iy+BRzwm7b1qQLRp2cl1jzAkRMGZQpy7C7j3/LIo9Xy72ncG7w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com; spf=pass smtp.mailfrom=samsung.com; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b=j0mzjQl0; arc=none smtp.client-ip=210.118.77.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samsung.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b="j0mzjQl0" Received: from eucas1p1.samsung.com (unknown [182.198.249.206]) by mailout1.w1.samsung.com (KnoxPortal) with ESMTP id 20260715123611euoutp0157b195db39872ed9136052643dfc289f~CdsB1kmkd1661816618euoutp01_ for ; Wed, 15 Jul 2026 12:36:11 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout1.w1.samsung.com 20260715123611euoutp0157b195db39872ed9136052643dfc289f~CdsB1kmkd1661816618euoutp01_ DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1784118971; bh=A6XmGwoyQK4IATTx7Sicb5Md/GOMK8vp+z2XevcvSds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j0mzjQl0/5yjujQR70Pvx+WWmS6qaZixVmpjPwtxf/vZGoJg6HodJZ05ghl9WYH0F zoGpXDV7KFyAsIltKelmMsnQRIkvdGPTQ/JgvFVfHsebEK+47ehj37Lu2w4Fs0snkI cDi6DuhQo/ZGaFg2wXCLSCHwaGjaAvSNzg10gv9k= Received: from eusmtip2.samsung.com (unknown [203.254.199.222]) by eucas1p1.samsung.com (KnoxPortal) with ESMTPA id 20260715123610eucas1p1487b60d74fe9741507fe744fe8e3132c~CdsBfDezb0259902599eucas1p1Y; Wed, 15 Jul 2026 12:36:10 +0000 (GMT) Received: from AMDC4843.eu.corp.samsungelectronics.net (unknown [106.120.77.61]) by eusmtip2.samsung.com (KnoxPortal) with ESMTPA id 20260715123610eusmtip2250609b51eddc41b7670006498b06290~CdsA2NKFQ0123201232eusmtip2v; Wed, 15 Jul 2026 12:36:10 +0000 (GMT) From: Jakub Raczynski To: netdev@vger.kernel.org Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, mcoquelin.stm32@gmail.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Jakub Raczynski Subject: [PATCH net v3 2/2] net/stmmac: Prevent dma queue NULL free on allocation failure Date: Wed, 15 Jul 2026 14:36:02 +0200 Message-Id: <20260715123602.51950-3-j.raczynski@samsung.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260715123602.51950-1-j.raczynski@samsung.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CMS-MailID: 20260715123610eucas1p1487b60d74fe9741507fe744fe8e3132c X-Msg-Generator: CA Content-Type: text/plain; charset="utf-8" X-RootMTR: 20260715123610eucas1p1487b60d74fe9741507fe744fe8e3132c X-EPHeader: CA X-CMS-RootMailID: 20260715123610eucas1p1487b60d74fe9741507fe744fe8e3132c References: <20260715123602.51950-1-j.raczynski@samsung.com> During allocation of RX/TX descriptor resources and its DMA, there is verification of failed dma_alloc_coherent() due to lack of memory. In case of that failure, all allocated resources are freed instantly after, but there are no checks for dma_free_coherent() whether previous step has failed. This will generally result in panic due to freeing NULL address. Fix it by adding NULL verification of memory that is to be freed. Also assign NULL to page pointers to avoid double free scenario. Fixes: e73b19baa3b1c ("net: stmmac: simplify DMA descriptor allocation/init= /freeing") Reported-by: Sashiko AI Signed-off-by: Jakub Raczynski --- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/ne= t/ethernet/stmicro/stmmac/stmmac_main.c index 3098971e0b66..77604d6ab466 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -2146,7 +2146,6 @@ static void __free_dma_rx_desc_resources(struct stmma= c_priv *priv, u32 queue) { struct stmmac_rx_queue *rx_q =3D &dma_conf->rx_queue[queue]; - size_t size; void *addr; =20 /* Release the DMA RX socket buffers */ @@ -2158,15 +2157,21 @@ static void __free_dma_rx_desc_resources(struct stm= mac_priv *priv, rx_q->buf_alloc_num =3D 0; rx_q->xsk_pool =3D NULL; =20 - /* Free DMA regions of consistent memory previously allocated */ - if (priv->extend_desc) + if (priv->extend_desc) { addr =3D rx_q->dma_erx; - else + rx_q->dma_erx =3D NULL; + } else { addr =3D rx_q->dma_rx; + rx_q->dma_rx =3D NULL; + } =20 - size =3D stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size; + /* Free DMA regions of consistent memory if previously allocated */ + if (addr) { + size_t size; + size =3D stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size; =20 - dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy); + dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy); + } =20 if (xdp_rxq_info_is_reg(&rx_q->xdp_rxq)) xdp_rxq_info_unreg(&rx_q->xdp_rxq); @@ -2198,7 +2203,6 @@ static void __free_dma_tx_desc_resources(struct stmma= c_priv *priv, u32 queue) { struct stmmac_tx_queue *tx_q =3D &dma_conf->tx_queue[queue]; - size_t size; void *addr; =20 /* Release the DMA TX socket buffers */ @@ -2206,15 +2210,21 @@ static void __free_dma_tx_desc_resources(struct stm= mac_priv *priv, =20 if (priv->extend_desc) { addr =3D tx_q->dma_etx; + tx_q->dma_etx =3D NULL; } else if (tx_q->tbs & STMMAC_TBS_AVAIL) { addr =3D tx_q->dma_entx; + tx_q->dma_entx =3D NULL; } else { addr =3D tx_q->dma_tx; + tx_q->dma_tx =3D NULL; } =20 - size =3D stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size; + if (addr) { + size_t size; + size =3D stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size; =20 - dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy); + dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy); + } =20 kfree(tx_q->tx_skbuff_dma); kfree(tx_q->tx_skbuff); --=20 2.34.1