* [PATCH net] net: lantiq: fix memory corruption in RX ring
@ 2021-05-20 18:40 Aleksander Jan Bajkowski
2021-05-20 22:24 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Aleksander Jan Bajkowski @ 2021-05-20 18:40 UTC (permalink / raw
To: hauke, davem, kuba, netdev, linux-kernel; +Cc: Aleksander Jan Bajkowski
In a situation where memory allocation or dma mapping fails, an
invalid address is programmed into the descriptor. This can lead
to memory corruption. If the memory allocation fails, DMA should
reuse the previous skb and mapping and drop the packet. This patch
also increments rx drop counter.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
---
drivers/net/ethernet/lantiq_xrx200.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c
index 41c2ad210bc9..36dc3e5f6218 100644
--- a/drivers/net/ethernet/lantiq_xrx200.c
+++ b/drivers/net/ethernet/lantiq_xrx200.c
@@ -154,6 +154,7 @@ static int xrx200_close(struct net_device *net_dev)
static int xrx200_alloc_skb(struct xrx200_chan *ch)
{
+ dma_addr_t mapping;
int ret = 0;
ch->skb[ch->dma.desc] = netdev_alloc_skb_ip_align(ch->priv->net_dev,
@@ -163,16 +164,17 @@ static int xrx200_alloc_skb(struct xrx200_chan *ch)
goto skip;
}
- ch->dma.desc_base[ch->dma.desc].addr = dma_map_single(ch->priv->dev,
- ch->skb[ch->dma.desc]->data, XRX200_DMA_DATA_LEN,
- DMA_FROM_DEVICE);
- if (unlikely(dma_mapping_error(ch->priv->dev,
- ch->dma.desc_base[ch->dma.desc].addr))) {
+ mapping = dma_map_single(ch->priv->dev, ch->skb[ch->dma.desc]->data,
+ XRX200_DMA_DATA_LEN, DMA_FROM_DEVICE);
+ if (unlikely(dma_mapping_error(ch->priv->dev, mapping))) {
dev_kfree_skb_any(ch->skb[ch->dma.desc]);
ret = -ENOMEM;
goto skip;
}
+ ch->dma.desc_base[ch->dma.desc].addr = mapping;
+ /* Make sure the address is written before we give it to HW */
+ wmb();
skip:
ch->dma.desc_base[ch->dma.desc].ctl =
LTQ_DMA_OWN | LTQ_DMA_RX_OFFSET(NET_IP_ALIGN) |
@@ -196,6 +198,8 @@ static int xrx200_hw_receive(struct xrx200_chan *ch)
ch->dma.desc %= LTQ_DESC_NUM;
if (ret) {
+ ch->skb[ch->dma.desc] = skb;
+ net_dev->stats.rx_dropped++;
netdev_err(net_dev, "failed to allocate new rx buffer\n");
return ret;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] net: lantiq: fix memory corruption in RX ring
2021-05-20 18:40 [PATCH net] net: lantiq: fix memory corruption in RX ring Aleksander Jan Bajkowski
@ 2021-05-20 22:24 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2021-05-20 22:24 UTC (permalink / raw
To: olek2; +Cc: hauke, kuba, netdev, linux-kernel
From: Aleksander Jan Bajkowski <olek2@wp.pl>
Date: Thu, 20 May 2021 20:40:54 +0200
> In a situation where memory allocation or dma mapping fails, an
> invalid address is programmed into the descriptor. This can lead
> to memory corruption. If the memory allocation fails, DMA should
> reuse the previous skb and mapping and drop the packet. This patch
> also increments rx drop counter.
>
> Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Please repost this with an appropriate Fixes: tag, thank you.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-20 22:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-05-20 18:40 [PATCH net] net: lantiq: fix memory corruption in RX ring Aleksander Jan Bajkowski
2021-05-20 22:24 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.