linux-kernel - Re: [PATCH v4] net: add Faraday FTMAC100 10/100 Ethernet driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTimWuBfeYPOsOFpTiAGS5uHysevAHiOg0svBQ4zW@mail.gmail.com>
Date:	Mon, 24 Jan 2011 21:22:03 +0100
From:	Michał Mirosław <mirqus@...il.com>
To:	Po-Yu Chuang <ratbert.chuang@...il.com>
Cc:	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	bhutchings@...arflare.com, eric.dumazet@...il.com, joe@...ches.com,
	dilinger@...ued.net, Po-Yu Chuang <ratbert@...aday-tech.com>
Subject: Re: [PATCH v4] net: add Faraday FTMAC100 10/100 Ethernet driver

W dniu 24 stycznia 2011 09:26 użytkownik Po-Yu Chuang
<ratbert.chuang@...il.com> napisał:
> 2011/1/21 Michał Mirosław <mirqus@...il.com>:
>> 2011/1/21 Po-Yu Chuang <ratbert.chuang@...il.com>:
>>> +static void ftmac100_free_buffers(struct ftmac100 *priv)
>>> +{
>>> +       int i;
>>> +
>>> +       for (i = 0; i < RX_QUEUE_ENTRIES; i += 2) {
>>> +               struct ftmac100_rxdes *rxdes = &priv->descs->rxdes[i];
>>> +               dma_addr_t d = ftmac100_rxdes_get_dma_addr(rxdes);
>>> +               void *page = ftmac100_rxdes_get_va(rxdes);
>>> +
>>> +               if (d)
>>> +                       dma_unmap_single(priv->dev, d, PAGE_SIZE,
>>> +                                        DMA_FROM_DEVICE);
>>> +
>>> +               if (page != NULL)
>>> +                       free_page((unsigned long)page);
>>> +       }
>>> +
>> [...]
>>
>>> +static int ftmac100_alloc_buffers(struct ftmac100 *priv)
>>> +{
>>> +       int i;
>>> +
>>> +       priv->descs = dma_alloc_coherent(priv->dev,
>>> +                                        sizeof(struct ftmac100_descs),
>>> +                                        &priv->descs_dma_addr,
>>> +                                        GFP_KERNEL | GFP_DMA);
>>> +       if (priv->descs == NULL)
>>> +               return -ENOMEM;
>>> +
>>> +       memset(priv->descs, 0, sizeof(struct ftmac100_descs));
>>> +
>>> +       /* initialize RX ring */
>>> +
>>> +       ftmac100_rxdes_set_end_of_ring(&priv->descs->rxdes[RX_QUEUE_ENTRIES - 1]);
>>> +
>>> +       for (i = 0; i < RX_QUEUE_ENTRIES; i += 2) {
>>> +               struct ftmac100_rxdes *rxdes = &priv->descs->rxdes[i];
>>> +               void *page;
>>> +               dma_addr_t d;
>>> +
>>> +               page = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
>>> +               if (page == NULL)
>>> +                       goto err;
>>> +
>>> +               d = dma_map_single(priv->dev, page, PAGE_SIZE, DMA_FROM_DEVICE);
>>> +               if (unlikely(dma_mapping_error(priv->dev, d))) {
>>> +                       free_page((unsigned long)page);
>>> +                       goto err;
>>> +               }
>>> +
>>> +               /*
>>> +                * The hardware enforces a sub-2K maximum packet size, so we
>>> +                * put two buffers on every hardware page.
>>> +                */
>>> +               ftmac100_rxdes_set_va(rxdes, page);
>>> +               ftmac100_rxdes_set_va(rxdes + 1, page + PAGE_SIZE / 2);
>>> +
>>> +               ftmac100_rxdes_set_dma_addr(rxdes, d);
>>> +               ftmac100_rxdes_set_dma_addr(rxdes + 1, d + PAGE_SIZE / 2);
>>> +
>>> +               ftmac100_rxdes_set_buffer_size(rxdes, RX_BUF_SIZE);
>>> +               ftmac100_rxdes_set_buffer_size(rxdes + 1, RX_BUF_SIZE);
>>> +
>>> +               ftmac100_rxdes_set_dma_own(rxdes);
>>> +               ftmac100_rxdes_set_dma_own(rxdes + 1);
>>> +       }
>> [...]
>>
>> Did you test this? This looks like it will result in double free after
>> packet RX, as you are giving the same page (referenced once) to two
>> distinct RX descriptors, that may be assigned different packets.
>
> Yes, this is tested.
>
>> Since your not implementing any RX offloads, you might just allocate
>> fresh skb's with alloc_skb() and store skb pointer in rxdes3. Since
>
> rxdes3 does not store virtual address of an skb.
> It stores the address of the buffer allocated while open() and freed
> only when stop().
> The data in that buffer will be memcpy()ed to an skb allocated in
> ftmac100_rx_packet().
> No double free happens.

Ah, I blindly assumed that you're just appending the buffers to the
skb (using skb_fill_page_desc() and friends). Since you have to mark
descriptors for the device anyway, it might be faster to allocate new
skbs and map those as rx buffers (changing the descriptor's buffer
address after every RX) instead of keeping static buffer and copying
every time. (For small packets it wastes lot of memory, though - so
the right choice depends on the expected workload.)

Best Regards,
Michał Mirosław
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/