Re: [PATCH net-next 6/8] eth: mpnic: add a netdevice and basic Tx handling

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: mpnic: invalid dma_map_single() with size 0 for completely paged SKBs
--

commit 8d7cf250060d2193a80aa7f55598e2da19bf8165
Author: Daniel Zahka <daniel.zahka@gmail.com>

eth: mpnic: add a netdevice and basic Tx handling

This commit registers the mpnic network interface and implements basic
transmit handling, including doorbell logic and descriptor mapping.

> diff --git a/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c b/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c
> index cb4d1427434c9..f4ad8caf6ce66 100644
> --- a/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c
> +++ b/drivers/net/ethernet/meta/mpnic/mpnic_txrx.c

[ ... ]

> @@ -67,6 +92,138 @@ static void mpnic_unmap_page_twd(struct device *dev, __le64 *twd)
>  		       FIELD_GET(MPNIC_TWD_LEN, raw_twd), DMA_TO_DEVICE);
>  }
>  
> +static bool
> +mpnic_tx_map(struct mpnic_ring *ring, struct sk_buff *skb, __le64 *meta)
> +{
> +	struct device *dev = skb->dev->dev.parent;
> +	unsigned int tail = ring->tail, first;
> +	unsigned int size, data_len;
> +	skb_frag_t *frag;
> +	dma_addr_t dma;
> +	__le64 *twd;
> +
> +	tail++;
> +	tail &= ring->size_mask;
> +	first = tail;
> +
> +	size = skb_headlen(skb);
> +	data_len = skb->data_len;
> +
> +	if (size > FIELD_MAX(MPNIC_TWD_LEN))
> +		goto err_dma;
> +
> +	dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);

[Severity: High]
Does this code map a zero-length region if the skb is completely paged?

If a completely paged skb is transmitted (for example, from an af_packet
socket) where the total length is large enough to bypass padding but
skb_headlen(skb) is 0, size will be 0 here.

Calling dma_map_single() with a size of 0 violates the DMA API contract and
triggers a WARN_ON_ONCE. It also submits a 0-length data descriptor to the
device, which might stall the transmit queue or crash the firmware.

> +
> +	for (frag = &skb_shinfo(skb)->frags[0];; frag++) {
> +		twd = &ring->desc[tail];

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922-linux-mpnic-v1-0-236844f53072@gmail.com?part=6