netdev - Re: [PATCH net 2/2] net: stmmac: avoid rx queue overrun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ysmqbuxjcgbcq4urtru5elda3dcbyejo2db3ds5cousy2trjdh@6fe774njbiam>
Date: Tue, 14 Nov 2023 19:04:21 +0300
From: Serge Semin <fancer.lancer@...il.com>
To: Baruch Siach <baruch@...s.co.il>
Cc: Alexandre Torgue <alexandre.torgue@...s.st.com>, 
	Jose Abreu <joabreu@...opsys.com>, netdev@...r.kernel.org
Subject: Re: [PATCH net 2/2] net: stmmac: avoid rx queue overrun

On Mon, Nov 13, 2023 at 07:42:50PM +0200, Baruch Siach wrote:
> dma_rx_size can be set as low as 64. Rx budget might be higher than
> that. Make sure to not overrun allocated rx buffers when budget is
> larger.
> 
> Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs
> 'cur_rx'.

Have you ever met the denoted problem? I am asking because what you
say can happen only if the incoming traffic overruns the Rx-buffer,
otherwise the loop will break on the first found DMA-own descriptor.
But if that happens AFAICS the result will likely to be fatal because
the stmmac_rx() method will try to handle the already handled and not
yet recycled descriptor with no buffers assigned.

So after adding the Fixes tag feel tree to add:
Reviewed-by: Serge Semin <fancer.lancer@...il.com>

-Serge(y)

> 
> Signed-off-by: Baruch Siach <baruch@...s.co.il>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index f28838c8cdb3..2afb2bd25977 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5293,6 +5293,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  
>  	dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
>  	buf_sz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
> +	limit = min(priv->dma_conf.dma_rx_size - 1, (unsigned int)limit);
>  
>  	if (netif_msg_rx_status(priv)) {
>  		void *rx_head;
> -- 
> 2.42.0
> 
>