[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250506132914.794416cc@wsk>
Date: Tue, 6 May 2025 13:29:14 +0200
From: Lukasz Majewski <lukma@...x.de>
To: Paolo Abeni <pabeni@...hat.com>
Cc: Andrew Lunn <andrew+netdev@...n.ch>, davem@...emloft.net, Eric Dumazet
<edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Rob Herring
<robh@...nel.org>, Krzysztof Kozlowski <krzk+dt@...nel.org>, Conor Dooley
<conor+dt@...nel.org>, Shawn Guo <shawnguo@...nel.org>, Sascha Hauer
<s.hauer@...gutronix.de>, Pengutronix Kernel Team <kernel@...gutronix.de>,
Fabio Estevam <festevam@...il.com>, Richard Cochran
<richardcochran@...il.com>, netdev@...r.kernel.org,
devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
imx@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org, Stefan Wahren
<wahrenst@....net>, Simon Horman <horms@...nel.org>, Andrew Lunn
<andrew@...n.ch>
Subject: Re: [net-next v11 4/7] net: mtip: The L2 switch driver for imx287
Hi Paolo,
> On 5/6/25 1:04 PM, Lukasz Majewski wrote:
> >> On 5/4/25 4:55 PM, Lukasz Majewski wrote:
> >>> + /* This does 16 byte alignment, exactly what we
> >>> need.
> >>> + * The packet length includes FCS, but we don't
> >>> want to
> >>> + * include that when passing upstream as it
> >>> messes up
> >>> + * bridging applications.
> >>> + */
> >>> + skb = netdev_alloc_skb(pndev, pkt_len +
> >>> NET_IP_ALIGN);
> >>> + if (unlikely(!skb)) {
> >>> + dev_dbg(&fep->pdev->dev,
> >>> + "%s: Memory squeeze, dropping
> >>> packet.\n",
> >>> + pndev->name);
> >>> + pndev->stats.rx_dropped++;
> >>> + goto err_mem;
> >>> + } else {
> >>> + skb_reserve(skb, NET_IP_ALIGN);
> >>> + skb_put(skb, pkt_len); /* Make room
> >>> */
> >>> + skb_copy_to_linear_data(skb, data,
> >>> pkt_len);
> >>> + skb->protocol = eth_type_trans(skb,
> >>> pndev);
> >>> + napi_gro_receive(&fep->napi, skb);
> >>> + }
> >>> +
> >>> + bdp->cbd_bufaddr =
> >>> dma_map_single(&fep->pdev->dev, data,
> >>> +
> >>> bdp->cbd_datlen,
> >>> +
> >>> DMA_FROM_DEVICE);
> >>> + if (unlikely(dma_mapping_error(&fep->pdev->dev,
> >>> +
> >>> bdp->cbd_bufaddr))) {
> >>> + dev_err(&fep->pdev->dev,
> >>> + "Failed to map descriptor rx
> >>> buffer\n");
> >>> + pndev->stats.rx_errors++;
> >>> + pndev->stats.rx_dropped++;
> >>> + dev_kfree_skb_any(skb);
> >>> + goto err_mem;
> >>> + }
> >>
> >> This is doing the mapping and ev. dropping the skb _after_ pushing
> >> the skb up the stack, you must attempt the mapping first.
> >>
> >>> +static void mtip_free_buffers(struct net_device *dev)
> >>> +{
> >>> + struct mtip_ndev_priv *priv = netdev_priv(dev);
> >>> + struct switch_enet_private *fep = priv->fep;
> >>> + struct sk_buff *skb;
> >>> + struct cbd_t *bdp;
> >>> + int i;
> >>> +
> >>> + bdp = fep->rx_bd_base;
> >>> + for (i = 0; i < RX_RING_SIZE; i++) {
> >>> + skb = fep->rx_skbuff[i];
> >>> +
> >>> + if (bdp->cbd_bufaddr)
> >>> + dma_unmap_single(&fep->pdev->dev,
> >>> bdp->cbd_bufaddr,
> >>> + MTIP_SWITCH_RX_FRSIZE,
> >>> + DMA_FROM_DEVICE);
> >>> + if (skb)
> >>> + dev_kfree_skb(skb);
> >>
> >> I suspect that on error paths mtip_free_buffers() can be invoked
> >> multiple consecutive times with any successful allocation in
> >> between: skb will be freed twice. Likely you need to clear
> >> fep->rx_skbuff[i] here.
> >
> > I don't know what I shall say now.... really...
>
> I suspect my email was not clear. AFAICS the current code contains at
> least 2 serious issues,
Yes, I'm now aware of them - thanks for pointing them out.
> possibly more not yet discovered due to the
> patch size.
> You need to submit (at least) a new revision coping with
> the provided feedback.
+1
>
> Thanks,
>
> Paolo
>
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma@...x.de
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists