From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6018B8635E; Mon, 6 Jan 2025 15:26:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736177160; cv=none; b=Ekt7Hg9CRlXG0F1mbYF0NL1ehxE3lRhe1SK6NqTFzzqmoFUszggW0PV6g9bHJpxpN9XJAT8LKAt04fgMYm197J044n9oPzMvRC/gVpZcAt1A2MYW1lnwn7gPOd5X3aeIi6k+qkClxIuuc/lfdkvTvcgcr4sk9RXSI4JR+d4kWOE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736177160; c=relaxed/simple; bh=C/uQlAV58VC4lRoVKGxwDtIPbIJH/0YfhqXDbBUNURo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Wr3ME/RBCtiEAIsPQrZMO+Ro+hIfnwnrYEQDAjDFYeOIaLV3QDmrSuqkgPR5RLAE9KmScN+DWNhiuultbU+HjJdER9qKbmbMpjAYjBL6Azelrdas23zSkrD4GHlpScvik05km/q2Nzx2txEURYsFdjdRzeZJd4wfq//Bi7UBKQc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ddulVw0L; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ddulVw0L" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0C7FC4CED2; Mon, 6 Jan 2025 15:25:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1736177160; bh=C/uQlAV58VC4lRoVKGxwDtIPbIJH/0YfhqXDbBUNURo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ddulVw0L+h53qNxnxSP9Z3drr7twQUPg0mwjyrgOE+JnqDfUGPo70G3fqqzEAN55c TxzHbn90dFM0v4AA2U561TY0csXi1V6BPtg0/El9bfvRfS4mELZxeEOkhvIZ4maIR0 yKAkLzNPTibqp0sFlv9+iguYQEU426gZxk7OZpjw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Nikita Yushchenko , Yoshihiro Shimoda , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 072/222] net: renesas: rswitch: fix possible early skb release Date: Mon, 6 Jan 2025 16:14:36 +0100 Message-ID: <20250106151153.328962565@linuxfoundation.org> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20250106151150.585603565@linuxfoundation.org> References: <20250106151150.585603565@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nikita Yushchenko [ Upstream commit 5cb099902b6b6292b3a85ffa1bb844e0ba195945 ] When sending frame split into multiple descriptors, hardware processes descriptors one by one, including writing back DT values. The first descriptor could be already marked as completed when processing of next descriptors for the same frame is still in progress. Although only the last descriptor is configured to generate interrupt, completion of the first descriptor could be noticed by the driver when handling interrupt for the previous frame. Currently, driver stores skb in the entry that corresponds to the first descriptor. This results into skb could be unmapped and freed when hardware did not complete the send yet. This opens a window for corrupting the data being sent. Fix this by saving skb in the entry that corresponds to the last descriptor used to send the frame. Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX") Signed-off-by: Nikita Yushchenko Reviewed-by: Yoshihiro Shimoda Link: https://patch.msgid.link/20241208095004.69468-2-nikita.yoush@cogentembedded.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/renesas/rswitch.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index 54aa56c84133..2f483531d95c 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1632,8 +1632,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd if (dma_mapping_error(ndev->dev.parent, dma_addr_orig)) goto err_kfree; - gq->skbs[gq->cur] = skb; - gq->unmap_addrs[gq->cur] = dma_addr_orig; + /* Stored the skb at the last descriptor to avoid skb free before hardware completes send */ + gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb; + gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig; dma_wmb(); -- 2.39.5