Re: [PATCH net-next v5 17/19] net: stmmac: retain DMA memory until hardware shutdown completes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] stmmac: DMA ring bounds overflow due to missing END_RING bit
--

commit 36cb013886a764ed37b1ecca4a71af772e7620a5
Author: James Hilliard <james.hilliard1@gmail.com>

net: stmmac: retain DMA memory until hardware shutdown completes

This commit modifies the stmmac driver to retain DMA memory and configurations
until hardware shutdown completes. It adds idle wait checks for DMA engines
and defers error recovery to process context to prevent memory corruption
from in-flight frames after stop requests.

> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index f5060924dae86..98dbc873e1c81 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c

[ ... ]

> +static int stmmac_reinit_dma_desc(struct stmmac_priv *priv)
> +{

[ ... ]

> +		/* Writeback format contains status, not buffer addresses. Rebuild
> +		 * read format from software ownership before publishing any OWN.
> +		 */
> +		memset(stmmac_get_rx_desc(priv, rx_q, 0), 0,
> +		       stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size);
> +		if (rx_q->xsk_pool) {
> +			dma_free_rx_xskbufs(priv, dma_conf, queue);
> +			/* Empty FILL rings are valid, including TX-only sockets. */
> +			stmmac_alloc_rx_buffers_zc(priv, dma_conf, queue);
> +		} else {

[ ... ]

> +		if (priv->descriptor_mode == STMMAC_CHAIN_MODE)
> +			stmmac_mode_init(priv, stmmac_get_rx_desc(priv, rx_q, 0),
> +					 rx_q->dma_rx_phy, dma_conf->dma_rx_size,
> +					 priv->extend_desc);
> +
> +		dma_wmb();
> +		for (i = 0; i < rx_q->buf_alloc_num; i++)
> +			stmmac_init_rx_desc(priv, stmmac_get_rx_desc(priv, rx_q, i),
> +					    priv->use_riwt, priv->descriptor_mode,
> +					    i == dma_conf->dma_rx_size - 1,
> +					    dma_conf->dma_buf_sz);

[Severity: High]
Does this loop leave the end-of-ring marker uninitialized if the ring is only
partially filled?

When stmmac_reinit_dma_desc() is called to rebuild descriptors, such as
during a suspend and resume cycle, and the interface uses AF_XDP sockets in
ring mode, the fill ring might be partially populated or empty.

Because the preceding memset() zeroes the entire descriptor array, any
previous end-of-ring bits are erased. Since this loop terminates at
buf_alloc_num instead of dma_rx_size, the final descriptor boundary marker
is never set when buf_alloc_num is less than dma_rx_size.

If the socket later refills the remainder of the ring via
stmmac_rx_refill_zc(), it sets the ownership bit but not the end-of-ring bit.
Could this cause the hardware DMA engine to increment its ring pointer past
the end of the allocated ring buffer, leading to out-of-bounds memory
corruption?

> +	}
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927-submit-stmmac-reset-fixes-v1-v5-0-feec6c14dd06@gmail.com?part=17