[PATCH net 0/2] net: stmmac: Premature loop termination check was ignored

[PATCH net 0/2] net: stmmac: Premature loop termination check was ignored

[Jochen Henneberg]

As proposed in [1] here is are the fixes as a patch series that do the
premature end-of-loop check within the goto loop.

Jochen Henneberg (2):
  net: stmmac: Premature loop termination check was ignored
  net: stmmac: Premature loop termination check was ignored

 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

[1] https://lore.kernel.org/all/Y%2FdiTAg2iUopr%2FOy@corigine.com/
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH net 1/2] net: stmmac: Premature loop termination check was ignored

[Jochen Henneberg]

The premature loop termination check makes sense only in case of the
jump to read_again where the count may have been updated. But
read_again did not include the check.

Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e4902a7bb61e..ea51c7c93101 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 			len = 0;
 		}
 
+read_again:
 		if (count >= limit)
 			break;
 
-read_again:
 		buf1_len = 0;
 		buf2_len = 0;
 		entry = next_entry;
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net 1/2] net: stmmac: Premature loop termination check was ignored

[Piotr Raczynski]

On Tue, Mar 14, 2023 at 01:37:58PM +0100, Jochen Henneberg wrote:
> The premature loop termination check makes sense only in case of the
> jump to read_again where the count may have been updated. But
> read_again did not include the check.

Your commit titles and messages seems identical in both patches, someone
may get confused, maybe you could change commit titles at least?

Or since those are very related one liner fixes, maybe combine them into
one?

Also a question, since you in generally goto backwards here, is it guarded from
an infinite loop (during some corner case scenario maybe)?

Other than that looks fine, thanks.
Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>

> 
> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index e4902a7bb61e..ea51c7c93101 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  			len = 0;
>  		}
>  
> +read_again:
>  		if (count >= limit)
>  			break;
>  
> -read_again:
>  		buf1_len = 0;
>  		buf2_len = 0;
>  		entry = next_entry;
> -- 
> 2.39.2
> 

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net 1/2] net: stmmac: Premature loop termination check was ignored

[Jochen Henneberg]

Piotr Raczynski <piotr.raczynski@intel.com> writes:

> On Tue, Mar 14, 2023 at 01:37:58PM +0100, Jochen Henneberg wrote:
>> The premature loop termination check makes sense only in case of the
>> jump to read_again where the count may have been updated. But
>> read_again did not include the check.
>
> Your commit titles and messages seems identical in both patches, someone
> may get confused, maybe you could change commit titles at least?
>
> Or since those are very related one liner fixes, maybe combine them into
> one?

I was told to split them into a series because the fixes apply to
different kernel versions.

>
> Also a question, since you in generally goto backwards here, is it guarded from
> an infinite loop (during some corner case scenario maybe)?

In theory I think this may happen, however, I would consider that to be
a different patch since it addresses a different issue.

>
> Other than that looks fine, thanks.
> Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>
>
>> 
>> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
>> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
>> ---
>>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> index e4902a7bb61e..ea51c7c93101 100644
>> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>>  			len = 0;
>>  		}
>>  
>> +read_again:
>>  		if (count >= limit)
>>  			break;
>>  
>> -read_again:
>>  		buf1_len = 0;
>>  		buf2_len = 0;
>>  		entry = next_entry;
>> -- 
>> 2.39.2
>> 


-- 
Henneberg - Systemdesign
Jochen Henneberg
Loehnfeld 26
21423 Winsen (Luhe)
--
Fon: +49 172 160 14 69
Url: https://www.henneberg-systemdesign.com

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net 1/2] net: stmmac: Premature loop termination check was ignored

[Piotr Raczynski]

On Tue, Mar 14, 2023 at 04:01:11PM +0100, Jochen Henneberg wrote:
> 
> Piotr Raczynski <piotr.raczynski@intel.com> writes:
> 
> > On Tue, Mar 14, 2023 at 01:37:58PM +0100, Jochen Henneberg wrote:
> >> The premature loop termination check makes sense only in case of the
> >> jump to read_again where the count may have been updated. But
> >> read_again did not include the check.
> >
> > Your commit titles and messages seems identical in both patches, someone
> > may get confused, maybe you could change commit titles at least?
> >
> > Or since those are very related one liner fixes, maybe combine them into
> > one?
> 
> I was told to split them into a series because the fixes apply to
> different kernel versions.
> 
Makes sense, thanks. However I'd still at least modify title to show
which patch fixes zc path or anything to distinguish them beside commit
sha.
> >
> > Also a question, since you in generally goto backwards here, is it guarded from
> > an infinite loop (during some corner case scenario maybe)?
> 
> In theory I think this may happen, however, I would consider that to be
> a different patch since it addresses a different issue.
> 

Right, it just caught my attention, probably just make sense to check
it.
> >
> > Other than that looks fine, thanks.
> > Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>
> >
> >> 
> >> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
> >> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
> >> ---
> >>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >> 
> >> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> >> index e4902a7bb61e..ea51c7c93101 100644
> >> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> >> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> >> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
> >>  			len = 0;
> >>  		}
> >>  
> >> +read_again:
> >>  		if (count >= limit)
> >>  			break;
> >>  
> >> -read_again:
> >>  		buf1_len = 0;
> >>  		buf2_len = 0;
> >>  		entry = next_entry;
> >> -- 
> >> 2.39.2
> >> 
> 
> 
> -- 
> Henneberg - Systemdesign
> Jochen Henneberg
> Loehnfeld 26
> 21423 Winsen (Luhe)
> --
> Fon: +49 172 160 14 69
> Url: https://www.henneberg-systemdesign.com

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net 1/2] net: stmmac: Premature loop termination check was ignored

[Jochen Henneberg]

Piotr Raczynski <piotr.raczynski@intel.com> writes:

> On Tue, Mar 14, 2023 at 04:01:11PM +0100, Jochen Henneberg wrote:
>> 
>> Piotr Raczynski <piotr.raczynski@intel.com> writes:
>> 
>> > On Tue, Mar 14, 2023 at 01:37:58PM +0100, Jochen Henneberg wrote:
>> >> The premature loop termination check makes sense only in case of the
>> >> jump to read_again where the count may have been updated. But
>> >> read_again did not include the check.
>> >
>> > Your commit titles and messages seems identical in both patches, someone
>> > may get confused, maybe you could change commit titles at least?
>> >
>> > Or since those are very related one liner fixes, maybe combine them into
>> > one?
>> 
>> I was told to split them into a series because the fixes apply to
>> different kernel versions.
>> 
> Makes sense, thanks. However I'd still at least modify title to show
> which patch fixes zc path or anything to distinguish them beside commit
> sha.

Will do.

>> >
>> > Also a question, since you in generally goto backwards here, is it guarded from
>> > an infinite loop (during some corner case scenario maybe)?
>> 
>> In theory I think this may happen, however, I would consider that to be
>> a different patch since it addresses a different issue.
>> 
>
> Right, it just caught my attention, probably just make sense to check
> it.

I will take a look. Really, from code readability the driver is in a bad
shape, comments do not match code, bool and int are mixed for flags and
bool parameters are set with int values, DMA memory barriers are set
inconsistently and many more. This makes it hard to be sure what things
really do and follow code paths. I will try to check this issue and
provide a fix if necessary.

Btw., shall I copy your Reviewed-by and the reviewed-by from previous
patches into the new series or do you set the tag again on the V2
series?

>> >
>> > Other than that looks fine, thanks.
>> > Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>
>> >
>> >> 
>> >> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
>> >> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
>> >> ---
>> >>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>> >>  1 file changed, 1 insertion(+), 1 deletion(-)
>> >> 
>> >> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> >> index e4902a7bb61e..ea51c7c93101 100644
>> >> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> >> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> >> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>> >>  			len = 0;
>> >>  		}
>> >>  
>> >> +read_again:
>> >>  		if (count >= limit)
>> >>  			break;
>> >>  
>> >> -read_again:
>> >>  		buf1_len = 0;
>> >>  		buf2_len = 0;
>> >>  		entry = next_entry;
>> >> -- 
>> >> 2.39.2
>> >> 
>> 
>> 
>> -- 
>> Henneberg - Systemdesign
>> Jochen Henneberg
>> Loehnfeld 26
>> 21423 Winsen (Luhe)
>> --
>> Fon: +49 172 160 14 69
>> Url: https://www.henneberg-systemdesign.com


-- 
Henneberg - Systemdesign
Jochen Henneberg
Loehnfeld 26
21423 Winsen (Luhe)
--
Fon: +49 172 160 14 69
Url: https://www.henneberg-systemdesign.com

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH net 2/2] net: stmmac: Premature loop termination check was ignored

[Jochen Henneberg]

The premature loop termination check makes sense only in case of the
jump to read_again where the count may have been updated. But
read_again did not include the check.

Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ea51c7c93101..4886668a54c5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5031,10 +5031,10 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
 			len = 0;
 		}
 
+read_again:
 		if (count >= limit)
 			break;
 
-read_again:
 		buf1_len = 0;
 		entry = next_entry;
 		buf = &rx_q->buf_pool[entry];
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH net V2 0/2] net: stmmac: Premature loop termination check was ignored

[Jochen Henneberg]

As proposed in [1] here is are the fixes as a patch series that do the
premature end-of-loop check within the goto loop.

The commit messages now tell us which rx path has been fixed.

Jochen Henneberg (2):
  net: stmmac: Premature loop termination check was ignored on rx
  net: stmmac: Premature loop termination check was ignored on ZC rx

 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

[1] https://lore.kernel.org/all/Y%2FdiTAg2iUopr%2FOy@corigine.com
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jochen Henneberg]

The premature loop termination check makes sense only in case of the
jump to read_again where the count may have been updated. But
read_again did not include the check.

Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e4902a7bb61e..ea51c7c93101 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 			len = 0;
 		}
 
+read_again:
 		if (count >= limit)
 			break;
 
-read_again:
 		buf1_len = 0;
 		buf2_len = 0;
 		entry = next_entry;
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Piotr Raczynski]

On Thu, Mar 16, 2023 at 08:59:39AM +0100, Jochen Henneberg wrote:
> The premature loop termination check makes sense only in case of the
> jump to read_again where the count may have been updated. But
> read_again did not include the check.
> 
> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index e4902a7bb61e..ea51c7c93101 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  			len = 0;
>  		}
>  
> +read_again:
>  		if (count >= limit)
>  			break;
>  
> -read_again:
>  		buf1_len = 0;
>  		buf2_len = 0;
>  		entry = next_entry;
> -- 
> 2.39.2
> 
LGTM, thanks.
Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jakub Kicinski]

On Thu, 16 Mar 2023 08:59:39 +0100 Jochen Henneberg wrote:
> The premature loop termination check makes sense only in case of the
> jump to read_again where the count may have been updated. But
> read_again did not include the check.
> 
> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index e4902a7bb61e..ea51c7c93101 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  			len = 0;
>  		}
>  
> +read_again:
>  		if (count >= limit)
>  			break;

Are you sure? Can you provide more detailed analysis?
Do you observe a problem / error in real life or is this theoretical?

As far as I can tell only path which jumps to read_again after doing
count++ is via the drain_data jump, but I can't tell how it's
discarding subsequent segments in that case..

> -read_again:
>  		buf1_len = 0;
>  		buf2_len = 0;
>  		entry = next_entry;


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jochen Henneberg]

Jakub Kicinski <kuba@kernel.org> writes:

> On Thu, 16 Mar 2023 08:59:39 +0100 Jochen Henneberg wrote:
>> The premature loop termination check makes sense only in case of the
>> jump to read_again where the count may have been updated. But
>> read_again did not include the check.
>> 
>> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
>> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
>> ---
>>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> index e4902a7bb61e..ea51c7c93101 100644
>> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> @@ -5221,10 +5221,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>>  			len = 0;
>>  		}
>>  
>> +read_again:
>>  		if (count >= limit)
>>  			break;
>
> Are you sure? Can you provide more detailed analysis?
> Do you observe a problem / error in real life or is this theoretical?

This is theoretical, I was hunting another bug and just stumbled over
the check which is, I think you agree, pointless right now. I did not
try to force execute that code path.

>
> As far as I can tell only path which jumps to read_again after doing
> count++ is via the drain_data jump, but I can't tell how it's
> discarding subsequent segments in that case..
>
>> -read_again:
>>  		buf1_len = 0;
>>  		buf2_len = 0;
>>  		entry = next_entry;

Correct. The read_again is triggered in case that the segment is not the
last segment of the frame:

		if (likely(status & rx_not_ls))
			goto read_again;

So in case there is no skb (queue error) it will keep increasing count
until the last segment has been found with released device DMA
ownership. So skb will not change while the goto loop is running, the
only thing that will change is that subsequent segments release device
DMA ownership. The dirty buffers are then cleaned up from
stmmac_rx_refill().

I think the driver code is really hard to read I have planned to cleanup
things later, however, this patch simply tries to prevent us from
returning a value greater than limit which could happen and would
definitely be wrong.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jakub Kicinski]

On Sat, 18 Mar 2023 09:38:12 +0100 Jochen Henneberg wrote:
> > Are you sure? Can you provide more detailed analysis?
> > Do you observe a problem / error in real life or is this theoretical?  
> 
> This is theoretical, I was hunting another bug and just stumbled over
> the check which is, I think you agree, pointless right now. I did not
> try to force execute that code path.

If you have the HW it's definitely worth doing. There is a fault
injection infra in Linus which allows to fail memory allocations.
Or you can just make a little patch to the driver to fake failing
every 1000th allocation.

> > As far as I can tell only path which jumps to read_again after doing
> > count++ is via the drain_data jump, but I can't tell how it's
> > discarding subsequent segments in that case..
> >  
> >> -read_again:
> >>  		buf1_len = 0;
> >>  		buf2_len = 0;
> >>  		entry = next_entry;  
> 
> Correct. The read_again is triggered in case that the segment is not the
> last segment of the frame:
> 
> 		if (likely(status & rx_not_ls))
> 			goto read_again;
> 
> So in case there is no skb (queue error) it will keep increasing count
> until the last segment has been found with released device DMA
> ownership. So skb will not change while the goto loop is running, the
> only thing that will change is that subsequent segments release device
> DMA ownership. The dirty buffers are then cleaned up from
> stmmac_rx_refill().

To be clear - I'm only looking at stmmac_rx(), that ZC one is even more
confusing.

Your patch makes sense, but I think it's not enough to make this code
work in case of memory allocation failure. AFAIU the device supports
scatter - i.e. receiving a single frame in multiple chunks. Each time
thru the loop we process one (or two?) chunks. But the code uses 
skb == NULL to decide whether it's the first chunk or not. So in case
of memory allocation error it will treat the second chunk as the first
(since skb will be NULL) and we'll get a malformed frame with missing
chunks sent to the stack. The driver should discard the entire frame
on failure..

> I think the driver code is really hard to read I have planned to cleanup
> things later, however, this patch simply tries to prevent us from
> returning a value greater than limit which could happen and would
> definitely be wrong.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jochen Henneberg]

Jakub Kicinski <kuba@kernel.org> writes:

> On Sat, 18 Mar 2023 09:38:12 +0100 Jochen Henneberg wrote:
>> > Are you sure? Can you provide more detailed analysis?
>> > Do you observe a problem / error in real life or is this theoretical?  
>> 
>> This is theoretical, I was hunting another bug and just stumbled over
>> the check which is, I think you agree, pointless right now. I did not
>> try to force execute that code path.
>
> If you have the HW it's definitely worth doing. There is a fault
> injection infra in Linus which allows to fail memory allocations.
> Or you can just make a little patch to the driver to fake failing
> every 1000th allocation.
>

I have the hardware available and will do the check.

>> > As far as I can tell only path which jumps to read_again after doing
>> > count++ is via the drain_data jump, but I can't tell how it's
>> > discarding subsequent segments in that case..
>> >  
>> >> -read_again:
>> >>  		buf1_len = 0;
>> >>  		buf2_len = 0;
>> >>  		entry = next_entry;  
>> 
>> Correct. The read_again is triggered in case that the segment is not the
>> last segment of the frame:
>> 
>> 		if (likely(status & rx_not_ls))
>> 			goto read_again;
>> 
>> So in case there is no skb (queue error) it will keep increasing count
>> until the last segment has been found with released device DMA
>> ownership. So skb will not change while the goto loop is running, the
>> only thing that will change is that subsequent segments release device
>> DMA ownership. The dirty buffers are then cleaned up from
>> stmmac_rx_refill().
>
> To be clear - I'm only looking at stmmac_rx(), that ZC one is even more
> confusing.
>
> Your patch makes sense, but I think it's not enough to make this code
> work in case of memory allocation failure. AFAIU the device supports
> scatter - i.e. receiving a single frame in multiple chunks. Each time
> thru the loop we process one (or two?) chunks. But the code uses 
> skb == NULL to decide whether it's the first chunk or not. So in case
> of memory allocation error it will treat the second chunk as the first
> (since skb will be NULL) and we'll get a malformed frame with missing
> chunks sent to the stack. The driver should discard the entire frame
> on failure..
>

Understood. However, this forces me to read the code and datahseet very
carefully to understand the details. I will do that, however, it will
take me some time.

For the ST and Synopsys people:
I could imagine that you would be able to fix this much faster than
I can, so if they want to work on this please let me know so I don't
waste my time on doing double work.

>> I think the driver code is really hard to read I have planned to cleanup
>> things later, however, this patch simply tries to prevent us from
>> returning a value greater than limit which could happen and would
>> definitely be wrong.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jakub Kicinski]

On Mon, 20 Mar 2023 10:04:54 +0100 Jochen Henneberg wrote:
> For the ST and Synopsys people:
> I could imagine that you would be able to fix this much faster than
> I can, so if they want to work on this please let me know so I don't
> waste my time on doing double work.

Don't hold your breath, we haven't heard from any of the maintainers 
in 2 years :( 

The drivers for CoTS IPs are really not great in general, I'm guessing
delivering solid code is both difficult for them (given customer
parametrization of each instance) and hard to fit into their business
process :(


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 1/2] net: stmmac: Premature loop termination check was ignored on rx

[Jochen Henneberg]

Jakub Kicinski <kuba@kernel.org> writes:

> On Mon, 20 Mar 2023 10:04:54 +0100 Jochen Henneberg wrote:
>> For the ST and Synopsys people:
>> I could imagine that you would be able to fix this much faster than
>> I can, so if they want to work on this please let me know so I don't
>> waste my time on doing double work.
>
> Don't hold your breath, we haven't heard from any of the maintainers 
> in 2 years :( 
>
> The drivers for CoTS IPs are really not great in general, I'm guessing
> delivering solid code is both difficult for them (given customer
> parametrization of each instance) and hard to fit into their business
> process :(

Thanks for your response. I will try to figure out the issue and work on
them, however, be patient as I can only limited time on this.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH net V2 2/2] net: stmmac: Premature loop termination check was ignored on ZC rx

[Jochen Henneberg]

The premature loop termination check makes sense only in case of the
jump to read_again where the count may have been updated. But
read_again did not include the check.

Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ea51c7c93101..4886668a54c5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5031,10 +5031,10 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
 			len = 0;
 		}
 
+read_again:
 		if (count >= limit)
 			break;
 
-read_again:
 		buf1_len = 0;
 		entry = next_entry;
 		buf = &rx_q->buf_pool[entry];
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 2/2] net: stmmac: Premature loop termination check was ignored on ZC rx

[Piotr Raczynski]

On Thu, Mar 16, 2023 at 08:59:40AM +0100, Jochen Henneberg wrote:
> The premature loop termination check makes sense only in case of the
> jump to read_again where the count may have been updated. But
> read_again did not include the check.
> 
> Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
> Signed-off-by: Jochen Henneberg <jh@henneberg-systemdesign.com>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index ea51c7c93101..4886668a54c5 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5031,10 +5031,10 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
>  			len = 0;
>  		}
>  
> +read_again:
>  		if (count >= limit)
>  			break;
>  
> -read_again:
>  		buf1_len = 0;
>  		entry = next_entry;
>  		buf = &rx_q->buf_pool[entry];
> -- 
> 2.39.2
> 
LGTM, thanks.
Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 0/2] net: stmmac: Premature loop termination check was ignored

[Horatiu Vultur]

The 03/16/2023 08:59, Jochen Henneberg wrote:
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
> 
> As proposed in [1] here is are the fixes as a patch series that do the
> premature end-of-loop check within the goto loop.
> 
> The commit messages now tell us which rx path has been fixed.

Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com>

> 
> Jochen Henneberg (2):
>   net: stmmac: Premature loop termination check was ignored on rx
>   net: stmmac: Premature loop termination check was ignored on ZC rx
> 
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> [1] https://lore.kernel.org/all/Y%2FdiTAg2iUopr%2FOy@corigine.com
> --
> 2.39.2
> 

-- 
/Horatiu

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH net V2 0/2] net: stmmac: Premature loop termination check was ignored

[Piotr Raczynski]

On Thu, Mar 16, 2023 at 08:59:38AM +0100, Jochen Henneberg wrote:
> As proposed in [1] here is are the fixes as a patch series that do the
> premature end-of-loop check within the goto loop.
> 
> The commit messages now tell us which rx path has been fixed.
> 
> Jochen Henneberg (2):
>   net: stmmac: Premature loop termination check was ignored on rx
>   net: stmmac: Premature loop termination check was ignored on ZC rx
Thanks for differentiating commit messages
> 
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> [1] https://lore.kernel.org/all/Y%2FdiTAg2iUopr%2FOy@corigine.com
> -- 
> 2.39.2
> 

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel