Skip to content

net: stmmac: fix oops when split header is enabled #3028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: adsp-6.12.0-y
Choose a base branch
from
+17 −3
Open

net: stmmac: fix oops when split header is enabled #3028

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
// SPDX-License-Identifier: GPL-2.0-only
/*******************************************************************************
This is the driver for the ST MAC 10/100/1000 on-chip Ethernet controllers.
Expand Down Expand Up @@ -1518,7 +1518,7 @@
{
struct stmmac_tx_queue *tx_q = &dma_conf->tx_queue[queue];

if (tx_q->tx_skbuff_dma[i].buf &&

Check warning on line 1521 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_gcc_arm / build 

gcc_fanalayzer: dereference of NULL '0' [CWE-476] [-Wanalyzer-null-dereference]
1521 | if (tx_q->tx_skbuff_dma[i].buf &&
| ~~~~~~~~~~~~~~~~~~~~~~^~~~
'stmmac_xdp_open': events 1-2
|
| 6921 | int stmmac_xdp_open(struct net_device *dev)
| | ^~~~~~~~~~~~~~~
| | |
| | (1) entry to 'stmmac_xdp_open'
|......
| 6934 | ret = alloc_dma_desc_resources(priv, &priv->dma_conf);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (2) calling 'alloc_dma_desc_resources' from 'stmmac_xdp_open'
|
+--> 'alloc_dma_desc_resources': events 3-6
|
| 2206 | static int alloc_dma_desc_resources(struct stmmac_priv *priv,
| | ^~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (3) entry to 'alloc_dma_desc_resources'
|......
| 2212 | if (ret)
| | ~
| | |
| | (4) following 'false' branch (when 'ret == 0')...
|......
| 2215 | ret = alloc_dma_tx_desc_resources(priv, dma_conf);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (5) ...to here
| | (6) calling 'alloc_dma_tx_desc_resources' from 'alloc_dma_desc_resources'
|
+--> 'alloc_dma_tx_desc_resources': events 7-10
|
| 2176 | static int alloc_dma_tx_desc_resources(struct stmmac_priv *priv,
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (7) entry to 'alloc_dma_tx_desc_resources'
|......
| 2184 | for (queue = 0; queue < tx_count; queue++) {
| | ~~~~~~~~~~~~~~~~
| | |
| | (8) following 'true' branch (when 'queue < tx_count')...
| 2185 | ret = __alloc_dma_tx_desc_resources(priv, dma_conf, queue);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (9) ...to here
| | (10) calling '__alloc_dma_tx_desc_resources' from 'alloc_dma_tx_desc_resources'
|
+--> '__alloc_dma_tx_desc_resources': event 11
|
| 2129 | static int __alloc_dma_tx_desc_resources(struct stmmac_priv *priv,
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (11) entry to '__alloc_dma_tx_desc_resources'
|
'__alloc_dma_tx_desc_resources': event 12
|
|./include/linux/slab.h:925:61:
| 925 | #define kmalloc_array(...) alloc_hooks(kmalloc_array_noprof(__VA_ARGS__))
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (12) calling 'kmalloc_array_noprof' from '__alloc_dma_tx_desc_resources'
tx_q->tx_skbuff_dma[i].buf_type != STMMAC_TXBUF_T_XDP_TX) {
if (tx_q->tx_skbuff_dma[i].map_as_page)
dma_unmap_page(priv->device,
Expand Down Expand Up @@ -2924,7 +2924,7 @@
{
u32 tx_channel_count = priv->plat->tx_queues_to_use;
u32 rx_channel_count = priv->plat->rx_queues_to_use;
u32 channels_to_check = tx_channel_count > rx_channel_count ?

Check warning on line 2927 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / checks / checks 

coccicheck: 42-43  WARNING opportunity for max()
tx_channel_count : rx_channel_count;
u32 chan;
int status[MAX_T(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)];
Expand Down Expand Up @@ -4884,13 +4884,27 @@
if (!priv->sph)
return 0;

/* Not last descriptor */
if (status & rx_not_ls)
/* For GMAC4, when split header is enabled, in some rare cases, the
* hardware does not fill buf2 of the first descriptor with payload.
* Thus we cannot assume buf2 is always fully filled if it is not
* the last descriptor. Otherwise, the length of buf2 of the second
* descriptor will be calculated wrong and cause an oops.
*
* If this is the last descriptor, 'plen' is the length of the
* received packet that was transferred to system memory.
* Otherwise, it is the accumulated number of bytes that have been
* transferred for the current packet.
*
* Thus 'plen - len' always gives the correct length of buf2.
*/

/* Not GMAC4 and not last descriptor */
if (!priv->plat->has_gmac4 && (status & rx_not_ls))
return priv->dma_conf.dma_buf_sz;

/* GMAC4 or last descriptor */
plen = stmmac_get_rx_frame_len(priv, p, coe);

/* Last descriptor */
return plen - len;
}

Expand Down Expand Up @@ -5267,7 +5281,7 @@
break;

read_again:
buf1_len = 0;

Check warning on line 5284 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_llvm_x86_64 / build 

clang_analyzer: Value stored to 'buf1_len' is never read [deadcode.DeadStores]
5284 | buf1_len = 0;
| ^ ~
entry = next_entry;
buf = &rx_q->buf_pool[entry];

Expand Down Expand Up @@ -5467,8 +5481,8 @@
if (count >= limit)
break;

buf1_len = 0;

Check warning on line 5484 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_llvm_x86_64 / build 

clang_analyzer: Value stored to 'buf1_len' is never read [deadcode.DeadStores]
5484 | buf1_len = 0;
| ^ ~
buf2_len = 0;

Check warning on line 5485 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_llvm_x86_64 / build 

clang_analyzer: Value stored to 'buf2_len' is never read [deadcode.DeadStores]
5485 | buf2_len = 0;
| ^ ~
entry = next_entry;
buf = &rx_q->buf_pool[entry];

Expand Down Expand Up @@ -5613,7 +5627,7 @@
} else if (buf1_len) {
dma_sync_single_for_cpu(priv->device, buf->addr,
buf1_len, dma_dir);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,

Check failure on line 5630 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_gcc_arm / build 

kernel_smatch: 'skb' dereferencing possible ERR_PTR()
buf->page, buf->page_offset, buf1_len,
priv->dma_conf.dma_buf_sz);

Expand All @@ -5625,7 +5639,7 @@
if (buf2_len) {
dma_sync_single_for_cpu(priv->device, buf->sec_addr,
buf2_len, dma_dir);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,

Check failure on line 5642 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_gcc_arm / build 

kernel_smatch: 'skb' dereferencing possible ERR_PTR()
buf->sec_page, 0, buf2_len,
priv->dma_conf.dma_buf_sz);

Expand All @@ -5651,7 +5665,7 @@
/* Driver level stripping. */
stmmac_rx_vlan(priv->dev, skb);

skb->protocol = eth_type_trans(skb, priv->dev);

Check failure on line 5668 in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

View workflow job for this annotation

GitHub Actions / build_gcc_arm / build 

kernel_smatch: 'skb' dereferencing possible ERR_PTR()

if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb))
skb_checksum_none_assert(skb);
Expand Down
Loading