Re: [PATCH net v3 1/4] net: mvpp2: sync RX data at the hardware packet offset

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] If SKB allocation fails after XDP processing, the buffer is recycled with a potentially truncated DMA sync size, leading to possible data corruption.
--

commit 2937dd51dcd41c34cf709a921bae57060051477d
Author: Til Kaiser <mail@tk154.de>

net: mvpp2: sync RX data at the hardware packet offset

mvpp2 programs the RX queue packet offset, so hardware writes received
data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at
dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the
unused headroom and misses the same number of bytes at the packet tail.

> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> index f442b874bb593..92a701f4fe3f5 100644
> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> @@ -3946,9 +3946,10 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
>  			dma_dir = DMA_FROM_DEVICE;
>  		}
>  
> -		dma_sync_single_for_cpu(dev->dev.parent, dma_addr,
> -					rx_bytes + MVPP2_MH_SIZE,
> -					dma_dir);
> +		dma_sync_single_range_for_cpu(dev->dev.parent, dma_addr,
> +					      MVPP2_SKB_HEADROOM,
> +					      rx_bytes + MVPP2_MH_SIZE,
> +					      dma_dir);
>  
>  		/* Buffer header not supported */
>  		if (rx_status & MVPP2_RXD_BUF_HDR)

[Severity: High]
Can recycling the buffer with a truncated DMA sync size corrupt memory?

Looking further down in mvpp2_rx(), if an XDP program shrinks the packet,
rx_bytes is updated to the smaller size:

	rx_bytes  = xdp.data_end - xdp.data;

If the subsequent build_skb() or slab_build_skb() allocation fails, the error
path recycles the buffer with the modified rx_bytes:

	if (!skb) {
		netdev_warn(port->dev, "skb build failed\n");
		if (pp) {
			page_pool_put_page(pp, virt_to_head_page(data),
					   rx_bytes + MVPP2_MH_SIZE,
					   true);

Because rx_bytes is truncated, does this leave dirty CPU cache lines at the
tail of the original packet uncleaned?

If the hardware reuses this buffer to DMA a new packet, random CPU cache
evictions of these dirty lines could silently corrupt the new packet data
in RAM on non-coherent architectures.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605121332.147397-1-mail@tk154.de?part=1