[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20230205201130.11303-2-jsc@umbraculum.org>
Date: Sun, 5 Feb 2023 21:11:27 +0100
From: Jonas Suhr Christensen <jsc@...raculum.org>
To: netdev@...r.kernel.org
Cc: jsc@...raculum.org, "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
Michal Simek <michal.simek@...inx.com>,
Harini Katakam <harini.katakam@....com>,
Haoyue Xu <xuhaoyue1@...ilicon.com>,
huangjunxian <huangjunxian6@...ilicon.com>,
Wang Qing <wangqing@...o.com>,
Yang Yingliang <yangyingliang@...wei.com>,
Esben Haabendal <esben@...nix.com>,
linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH net v2 1/2] net: ll_temac: Fix DMA resources leak
Add missing conversion of address when unmapping dma region causing
unmapping to silently fail. At some point resulting in buffer
overrun eg. when releasing device.
Fixes: fdd7454ecb29 ("net: ll_temac: Fix support for little-endian platforms")
Signed-off-by: Jonas Suhr Christensen <jsc@...raculum.org>
---
drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1066420d6a83..74423adbe50d 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -299,6 +299,7 @@ static int temac_dcr_setup(struct temac_local *lp, struct platform_device *op,
static void temac_dma_bd_release(struct net_device *ndev)
{
struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *bd;
int i;
/* Reset Local Link (DMA) */
@@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev)
for (i = 0; i < lp->rx_bd_num; i++) {
if (!lp->rx_skb[i])
break;
- dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys,
+
+ bd = &lp->rx_bd_v[i];
+ dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys),
XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE);
+ bd->phys = 0;
+ bd->len = 0;
dev_kfree_skb(lp->rx_skb[i]);
+ lp->rx_skb[i] = NULL;
}
if (lp->rx_bd_v)
dma_free_coherent(ndev->dev.parent,
--
2.39.1
Powered by blists - more mailing lists