netdev - RE: [PATCH net v2] net: xilinx: axienet: Add error handling for RX metadata pointer retrieval

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <MN0PR12MB5953745D77A76528DDFD72E5B706A@MN0PR12MB5953.namprd12.prod.outlook.com>
Date: Tue, 2 Sep 2025 05:35:03 +0000
From: "Pandey, Radhey Shyam" <radhey.shyam.pandey@....com>
To: "Joseph, Abin" <Abin.Joseph@....com>, "andrew+netdev@...n.ch"
	<andrew+netdev@...n.ch>, "davem@...emloft.net" <davem@...emloft.net>,
	"edumazet@...gle.com" <edumazet@...gle.com>, "kuba@...nel.org"
	<kuba@...nel.org>, "pabeni@...hat.com" <pabeni@...hat.com>, "Simek, Michal"
	<michal.simek@....com>
CC: "git (AMD-Xilinx)" <git@....com>, "Joseph, Abin" <Abin.Joseph@....com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: RE: [PATCH net v2] net: xilinx: axienet: Add error handling for RX
 metadata pointer retrieval

[AMD Official Use Only - AMD Internal Distribution Only]

> -----Original Message-----
> From: Abin Joseph <abin.joseph@....com>
> Sent: Tuesday, September 2, 2025 7:02 AM
> To: Pandey, Radhey Shyam <radhey.shyam.pandey@....com>;
> andrew+netdev@...n.ch; davem@...emloft.net; edumazet@...gle.com;
> kuba@...nel.org; pabeni@...hat.com; Simek, Michal <michal.simek@....com>
> Cc: git (AMD-Xilinx) <git@....com>; Joseph, Abin <Abin.Joseph@....com>;
> netdev@...r.kernel.org; linux-arm-kernel@...ts.infradead.org; linux-
> kernel@...r.kernel.org; stable@...r.kernel.org
> Subject: [PATCH net v2] net: xilinx: axienet: Add error handling for RX metadata
> pointer retrieval
>
> Add proper error checking for dmaengine_desc_get_metadata_ptr() which
> can return an error pointer and lead to potential crashes or undefined
> behaviour if the pointer retrieval fails.
>
> Properly handle the error by unmapping DMA buffer, freeing the skb and
> returning early to prevent further processing with invalid data.
>
> Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support")
> Signed-off-by: Abin Joseph <abin.joseph@....com>

Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@....com>
With one minor comment below-

> ---
>
> Changes in v2:
> Update the alias to net
>
> ---
>  drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index 0d8a05fe541a..83469f7f08d1 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -1166,8 +1166,18 @@ static void axienet_dma_rx_cb(void *data, const struct
> dmaengine_result *result)
>       skb = skbuf_dma->skb;
>       app_metadata = dmaengine_desc_get_metadata_ptr(skbuf_dma->desc,
> &meta_len,
>                                                      &meta_max_len);
> +

This is unrelated change.

>       dma_unmap_single(lp->dev, skbuf_dma->dma_address, lp->max_frm_size,
>                        DMA_FROM_DEVICE);
> +
> +     if (IS_ERR(app_metadata)) {
> +             if (net_ratelimit())
> +                     netdev_err(lp->ndev, "Failed to get RX metadata pointer\n");
> +             dev_kfree_skb_any(skb);
> +             lp->ndev->stats.rx_dropped++;
> +             goto rx_submit;
> +     }
> +
>       /* TODO: Derive app word index programmatically */
>       rx_len = (app_metadata[LEN_APP] & 0xFFFF);
>       skb_put(skb, rx_len);
> @@ -1180,6 +1190,7 @@ static void axienet_dma_rx_cb(void *data, const struct
> dmaengine_result *result)
>       u64_stats_add(&lp->rx_bytes, rx_len);
>       u64_stats_update_end(&lp->rx_stat_sync);
>
> +rx_submit:
>       for (i = 0; i < CIRC_SPACE(lp->rx_ring_head, lp->rx_ring_tail,
>                                  RX_BUF_NUM_DEFAULT); i++)
>               axienet_rx_submit_desc(lp->ndev);
> --
> 2.34.1


Download attachment "winmail.dat" of type "application/ms-tnef" (18274 bytes)