From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Sergio Perez Gonzalez <sperezglz@gmail.com>,
Claudiu Beznea <claudiu.beznea@tuxon.dev>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>,
nicolas.ferre@microchip.com
Subject: [PATCH AUTOSEL 5.10 01/27] net: macb: Check return value of dma_set_mask_and_coherent()
Date: Tue, 3 Jun 2025 21:05:54 -0400 [thread overview]
Message-ID: <20250604010620.6819-1-sashal@kernel.org> (raw)
From: Sergio Perez Gonzalez <sperezglz@gmail.com>
[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ]
Issue flagged by coverity. Add a safety check for the return value
of dma_set_mask_and_coherent, go to a safe exit if it returns error.
Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1643754
Signed-off-by: Sergio Perez Gonzalez <sperezglz@gmail.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Link: https://patch.msgid.link/20250526032034.84900-1-sperezglz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Based on my analysis of the commit and the codebase context, here's my
assessment: **YES** This commit should be backported to stable kernel
trees. Here's my extensive analysis: ## Code Analysis The commit adds
proper error checking for `dma_set_mask_and_coherent()` in the macb
network driver. Looking at the specific changes: **Before the fix:**
```c if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); bp->hw_dma_cap
|= HW_DMA_CAP_64B; } ``` **After the fix:** ```c if (GEM_BFEXT(DAW64,
gem_readl(bp, DCFG6))) { err = dma_set_mask_and_coherent(&pdev->dev,
DMA_BIT_MASK(44)); if (err) { dev_err(&pdev->dev, "failed to set DMA
mask\n"); goto err_out_free_netdev; } bp->hw_dma_cap |= HW_DMA_CAP_64B;
} ``` ## Why this should be backported: 1. **Fixes a Real Bug**: The
original code ignores the return value of `dma_set_mask_and_coherent()`.
If this function fails (which can happen on systems with restricted DMA
capabilities), the driver would continue execution assuming 44-bit DMA
addressing is available when it's not, leading to potential memory
corruption or system crashes. 2. **Small, Contained Fix**: This is a
minimal change that only adds proper error checking without changing any
core logic or introducing new features. It follows the stable tree
principle of being a small, targeted bugfix. 3. **Follows Established
Patterns**: Looking at the similar commits provided, this matches
exactly the pattern of commits marked "YES" for backporting (commits #1,
#2, and #5) which all add proper error checking for DMA mask functions.
4. **Critical Network Driver**: The macb driver is used in production
systems, and DMA-related bugs can cause data corruption or system
instability, making this a high-priority fix for stable trees. 5.
**Proper Error Handling Path**: The fix correctly uses the existing
`err_out_free_netdev` label, which properly cleans up allocated
resources (line 5373-5383 in macb_main.c), preventing resource leaks
when DMA setup fails. 6. **Static Analysis Tool Flagged**: The commit
message mentions this was flagged by Coverity, indicating it's a
legitimate code quality issue that could manifest as a runtime bug. 7.
**Matches Stable Tree Criteria**: - Important bugfix ✓ - Minimal risk of
regression ✓ - No architectural changes ✓ - Confined to one
driver/subsystem ✓ - Clear side effects (proper cleanup on failure) ✓
This commit addresses the same class of vulnerability as the other "YES"
examples: ignoring return values of critical DMA functions that can fail
and lead to undefined behavior. The fix is surgical, safe, and addresses
a genuine runtime issue in a widely-used network driver.
drivers/net/ethernet/cadence/macb_main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 0f18837def3c8..4d3332d96e086 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -4578,7 +4578,11 @@ static int macb_probe(struct platform_device *pdev)
#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
+ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
+ if (err) {
+ dev_err(&pdev->dev, "failed to set DMA mask\n");
+ goto err_out_free_netdev;
+ }
bp->hw_dma_cap |= HW_DMA_CAP_64B;
}
#endif
--
2.39.5
next reply other threads:[~2025-06-04 1:06 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-04 1:05 Sasha Levin [this message]
2025-06-04 1:05 ` [PATCH AUTOSEL 5.10 02/27] tipc: use kfree_sensitive() for aead cleanup Sasha Levin
2025-06-04 1:05 ` [PATCH AUTOSEL 5.10 03/27] i2c: designware: Invoke runtime suspend on quick slave re-registration Sasha Levin
2025-06-04 1:05 ` [PATCH AUTOSEL 5.10 04/27] emulex/benet: correct command version selection in be_cmd_get_stats() Sasha Levin
2025-06-04 1:05 ` [PATCH AUTOSEL 5.10 05/27] wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R Sasha Levin
2025-06-04 1:05 ` [PATCH AUTOSEL 5.10 06/27] sctp: Do not wake readers in __sctp_write_space() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 07/27] i2c: npcm: Add clock toggle recovery Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 08/27] net: dlink: add synchronization for stats update Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 09/27] tcp: always seek for minimal rtt in tcp_rcv_rtt_update() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 10/27] tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 11/27] ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 12/27] openvswitch: Stricter validation for the userspace action Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 13/27] net: atlantic: generate software timestamp just before the doorbell Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 14/27] pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 15/27] pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 16/27] pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 17/27] pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 18/27] net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 19/27] wifi: mac80211: do not offer a mesh path if forwarding is disabled Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 20/27] clk: rockchip: rk3036: mark ddrphy as critical Sasha Levin
2025-06-04 1:06 ` Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 21/27] scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 22/27] iommu/amd: Ensure GA log notifier callbacks finish running before module unload Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 23/27] vxlan: Do not treat dst cache initialization errors as fatal Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 24/27] software node: Correct a OOB check in software_node_get_reference_args() Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 25/27] scsi: lpfc: Use memcpy() for BIOS version Sasha Levin
2025-06-04 1:06 ` [PATCH AUTOSEL 5.10 26/27] sock: Correct error checking condition for (assign|release)_proto_idx() Sasha Levin
2025-06-04 1:06 ` [Intel-wired-lan] [PATCH AUTOSEL 5.10 27/27] i40e: fix MMIO write access to an invalid page in i40e_clear_hw Sasha Levin
2025-06-04 1:06 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250604010620.6819-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=claudiu.beznea@tuxon.dev \
--cc=kuba@kernel.org \
--cc=nicolas.ferre@microchip.com \
--cc=patches@lists.linux.dev \
--cc=sperezglz@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.