linux-kernel - RE: [PATCH net 1/8] net: enetc: fix the off-by-one issue in enetc_map_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <PAXPR04MB851032041A21AC65C0C77EB588FA2@PAXPR04MB8510.eurprd04.prod.outlook.com>
Date: Tue, 18 Feb 2025 06:08:48 +0000
From: Wei Fang <wei.fang@....com>
To: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
CC: Claudiu Manoil <claudiu.manoil@....com>, Vladimir Oltean
	<vladimir.oltean@....com>, Clark Wang <xiaoning.wang@....com>,
	"andrew+netdev@...n.ch" <andrew+netdev@...n.ch>, "davem@...emloft.net"
	<davem@...emloft.net>, "edumazet@...gle.com" <edumazet@...gle.com>,
	"kuba@...nel.org" <kuba@...nel.org>, "pabeni@...hat.com" <pabeni@...hat.com>,
	Ioana Ciornei <ioana.ciornei@....com>, "Y.B. Lu" <yangbo.lu@....com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"imx@...ts.linux.dev" <imx@...ts.linux.dev>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: RE: [PATCH net 1/8] net: enetc: fix the off-by-one issue in
 enetc_map_tx_buffs()

> -----Original Message-----
> From: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
> Sent: 2025年2月18日 13:45
> To: Wei Fang <wei.fang@....com>
> Cc: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>; Claudiu Manoil
> <claudiu.manoil@....com>; Vladimir Oltean <vladimir.oltean@....com>;
> Clark Wang <xiaoning.wang@....com>; andrew+netdev@...n.ch;
> davem@...emloft.net; edumazet@...gle.com; kuba@...nel.org;
> pabeni@...hat.com; Ioana Ciornei <ioana.ciornei@....com>; Y.B. Lu
> <yangbo.lu@....com>; netdev@...r.kernel.org; linux-kernel@...r.kernel.org;
> imx@...ts.linux.dev; stable@...r.kernel.org
> Subject: Re: [PATCH net 1/8] net: enetc: fix the off-by-one issue in
> enetc_map_tx_buffs()
> 
> On Tue, Feb 18, 2025 at 02:11:12AM +0000, Wei Fang wrote:
> > > > Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet
> > > drivers")
> > > > Cc: stable@...r.kernel.org
> > > > Signed-off-by: Wei Fang <wei.fang@....com>
> > > > ---
> > > >  drivers/net/ethernet/freescale/enetc/enetc.c | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c
> > > b/drivers/net/ethernet/freescale/enetc/enetc.c
> > > > index 6a6fc819dfde..f7bc2fc33a76 100644
> > > > --- a/drivers/net/ethernet/freescale/enetc/enetc.c
> > > > +++ b/drivers/net/ethernet/freescale/enetc/enetc.c
> > > > @@ -372,13 +372,13 @@ static int enetc_map_tx_buffs(struct
> enetc_bdr
> > > *tx_ring, struct sk_buff *skb)
> > > >  dma_err:
> > > >  	dev_err(tx_ring->dev, "DMA map error");
> > > >
> > > > -	do {
> > > > +	while (count--) {
> > > >  		tx_swbd = &tx_ring->tx_swbd[i];
> > > >  		enetc_free_tx_frame(tx_ring, tx_swbd);
> > > >  		if (i == 0)
> > > >  			i = tx_ring->bd_count;
> > > >  		i--;
> > > > -	} while (count--);
> > > > +	};
> > >
> > > In enetc_lso_hw_offload() this is fixed by --count instead of changing
> > > to while and count--, maybe follow this scheme, or event better call
> > > helper function to fix in one place.
> >
> > The situation is slightly different in enetc_map_tx_buffs(), the count
> > may be 0 when the error occurs. But in enetc_lso_hw_offload(), the
> > count will not be 0 when the error occurs.
> 
> Right, didn't see that, sorry.
> 
> >
> > >
> > > The same problem is probably in enetc_map_tx_tso_buffs().
> > >
> >
> > I think there is no such problem in enetc_map_tx_tso_buffs(),
> > because the index 'i' has been increased before the error occurs,
> > but the count is not increased, so the actual 'count' is count + 1.
> >
> 
> But you can reach the error code jumping to label "err_chained_bd" where
> both i and count is increased. Isn't it a problem?
> 
You are right, I ignored this label. I will add a separate patch to fix this issue.
Thanks.

> BTW, not increasing i and count in one place looks like unnecessary
> complication ;) .
>