netdev - Re: [PATCH] net: ravb: Fix wrong dma_unmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 13 Jan 2024 12:47:48 +0300
From: Sergey Shtylyov <s.shtylyov@....ru>
To: Nikita Yushchenko <nikita.yoush@...entembedded.com>, "David S. Miller"
	<davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>
CC: Claudiu Beznea <claudiu.beznea.uj@...renesas.com>, Yoshihiro Shimoda
	<yoshihiro.shimoda.uh@...esas.com>, Wolfram Sang
	<wsa+renesas@...g-engineering.com>, Uwe Kleine-König
	<u.kleine-koenig@...gutronix.de>, <netdev@...r.kernel.org>,
	<linux-renesas-soc@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] net: ravb: Fix wrong dma_unmap_single() calls in ring
 unmapping

On 1/13/24 7:47 AM, Nikita Yushchenko wrote:

> When unmapping ring entries on Rx ring release, ravb driver needs to
> unmap only those entries that have been mapped successfully.
> 
> To check if an entry needs to be unmapped, currently the address stored
> inside descriptor is passed to dma_mapping_error() call. But, address
> field inside descriptor is 32-bit, while dma_mapping_error() is
> implemented by comparing it's argument with DMA_MAPPING_ERROR constant
> that is 64-bit when dma_addr_t is 64-bit. So the comparison gets wrong,
> resulting into ravb driver calling dma_unnmap_single() for 0xffffffff

   It's dma_unmap_single(). :-)

> address.
> 
> When the ring entries are mapped, in case of mapping failure the driver
> sets descriptor's size field to zero (which is a signal to hardware to
> not use this descriptor). Fix ring unmapping to detect if an entry needs
> to be unmapped by checking for zero size field.
> 
> Fixes: a47b70ea86bd ("ravb: unmap descriptors when freeing rings")
> Signed-off-by: Nikita Yushchenko <nikita.yoush@...entembedded.com>

Reviewed-by: Sergey Shtylyov <s.shtylyov@....ru>

[...]

> diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
> index 0e3731f50fc2..4d4b5d44c4e7 100644
> --- a/drivers/net/ethernet/renesas/ravb_main.c
> +++ b/drivers/net/ethernet/renesas/ravb_main.c
> @@ -256,8 +256,7 @@ static void ravb_rx_ring_free_gbeth(struct net_device *ndev, int q)
>  	for (i = 0; i < priv->num_rx_ring[q]; i++) {
>  		struct ravb_rx_desc *desc = &priv->gbeth_rx_ring[i];
>  
> -		if (!dma_mapping_error(ndev->dev.parent,
> -				       le32_to_cpu(desc->dptr)))
> +		if (le16_to_cpu(desc->ds_cc) != 0)

   It's not that != 0 or le16_to_cpu() are necessary here but we're on
the little-endian platforms anyways...

[...]
> @@ -281,8 +280,7 @@ static void ravb_rx_ring_free_rcar(struct net_device *ndev, int q)
>  	for (i = 0; i < priv->num_rx_ring[q]; i++) {
>  		struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
>  
> -		if (!dma_mapping_error(ndev->dev.parent,
> -				       le32_to_cpu(desc->dptr)))
> +		if (le16_to_cpu(desc->ds_cc) != 0)
>  			dma_unmap_single(ndev->dev.parent,
>  					 le32_to_cpu(desc->dptr),
>  					 RX_BUF_SZ,

MBR, Sergey