Re: [PATCH net-next v4 03/10] net: airoha: Move airoha_qdma pointer in airoha_gdm_dev struct

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2854 bytes --]

> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> Subject: net: airoha: Move airoha_qdma pointer in airoha_gdm_dev struct
> 
> This patch moves the airoha_qdma pointer from struct airoha_gdm_port into
> struct airoha_gdm_dev, as a preparation for allowing multiple net_devices
> to share the same GDM{3,4} port via an external hw arbiter.
> 
> > diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
> > index 4af64f182968..1798b4a6cf5d 100644
> > --- a/drivers/net/ethernet/airoha/airoha_eth.c
> > +++ b/drivers/net/ethernet/airoha/airoha_eth.c
> 
> [ ... ]
> 
> > @@ -854,7 +855,8 @@ static void airoha_qdma_wake_netdev_txqs(struct airoha_queue *q)
> >  		if (!port)
> >  			continue;
> >  
> > -		if (port->qdma != qdma)
> > +		dev = port->dev;
> > +		if (dev->qdma != qdma)
> >  			continue;
> >  
> >  		dev = port->dev;
> 
> [Low]
> The resulting loop body assigns dev = port->dev; twice with nothing in
> between that could change port->dev:
> 
> 	dev = port->dev;
> 	if (dev->qdma != qdma)
> 		continue;
> 
> 	dev = port->dev;
> 	for (j = 0; j < dev->dev->num_tx_queues; j++) {

ack, I will fix it in v5.

> 
> Is the second dev = port->dev; intentional, or leftover from the
> refactor that should be removed?
> 
> [Medium]
> Can the new dev->qdma dereference run while port->dev is still NULL?
> 
> Looking at airoha_alloc_gdm_port(), eth->ports[p] = port is stored before
> airoha_alloc_gdm_device() runs, and airoha_alloc_gdm_device() only sets
> port->dev = dev at its very end, after several failure points
> (devm_alloc_etherdev_mqs, netif_set_real_num_tx_queues,
> of_get_ethdev_address).
> 
> The existing cleanup in airoha_probe's error_napi_stop path and in
> airoha_remove guards accesses with if (dev && ...) when reading
> port->dev, which suggests port->dev can legitimately be NULL while
> eth->ports[i] is non-NULL.
> 
> Before the patch the equivalent check read port->qdma (an embedded field
> zeroed by devm_kzalloc), so the compare was NULL-tolerant. After the
> patch:
> 
> 	struct airoha_gdm_port *port = eth->ports[i];
> 	struct airoha_gdm_dev *dev;
> 	...
> 	if (!port)
> 		continue;
> 
> 	dev = port->dev;
> 	if (dev->qdma != qdma)
> 		continue;
> 
> would dereference a NULL dev if port->dev has not yet been assigned when
> airoha_qdma_wake_netdev_txqs() runs. Would a NULL check on port->dev (or
> reverting to the original port-field-based test) be appropriate here to
> preserve the prior robustness?

Even if this is not a real issue since it will be fixed by a following patch 
in the series ("Support multiple net_devices for a single FE GDM port "), I
will fix it in v5.

Regards,
Lorenzo

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]