* [PATCH 1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
2016-03-07 22:33 [PATCH 0/2] sh_eth: fix couple of bugs in sh_eth_ring_format() Sergei Shtylyov
@ 2016-03-07 22:36 ` Sergei Shtylyov
2016-03-07 22:37 ` [PATCH 2/2] sh_eth: advance 'rxdesc' later " Sergei Shtylyov
2016-03-10 21:07 ` [PATCH 0/2] sh_eth: fix couple of bugs " David Miller
2 siblings, 0 replies; 6+ messages in thread
From: Sergei Shtylyov @ 2016-03-07 22:36 UTC (permalink / raw)
To: netdev; +Cc: linux-renesas-soc
In a low memory situation, if netdev_alloc_skb() fails on a first RX ring
loop iteration in sh_eth_ring_format(), 'rxdesc' is still NULL. Avoid
kernel oops by adding the 'rxdesc' check after the loop.
Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
---
drivers/net/ethernet/renesas/sh_eth.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
Index: net/drivers/net/ethernet/renesas/sh_eth.c
===================================================================
--- net.orig/drivers/net/ethernet/renesas/sh_eth.c
+++ net/drivers/net/ethernet/renesas/sh_eth.c
@@ -1163,7 +1163,8 @@ static void sh_eth_ring_format(struct ne
mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);
/* Mark the last entry as wrapping the ring. */
- rxdesc->status |= cpu_to_le32(RD_RDLE);
+ if (rxdesc)
+ rxdesc->status |= cpu_to_le32(RD_RDLE);
memset(mdp->tx_ring, 0, tx_ringsize);
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
2016-03-07 22:33 [PATCH 0/2] sh_eth: fix couple of bugs in sh_eth_ring_format() Sergei Shtylyov
2016-03-07 22:36 ` [PATCH 1/2] sh_eth: fix NULL pointer dereference " Sergei Shtylyov
@ 2016-03-07 22:37 ` Sergei Shtylyov
2016-03-10 21:07 ` [PATCH 0/2] sh_eth: fix couple of bugs " David Miller
2 siblings, 0 replies; 6+ messages in thread
From: Sergei Shtylyov @ 2016-03-07 22:37 UTC (permalink / raw)
To: netdev; +Cc: linux-renesas-soc
Iff dma_map_single() fails, 'rxdesc' should point to the last filled RX
descriptor, so that it can be marked as the last one, however the driver
would have already advanced it by that time. In order to fix that, only
fill an RX descriptor once all the data for it is ready.
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
---
drivers/net/ethernet/renesas/sh_eth.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
Index: net/drivers/net/ethernet/renesas/sh_eth.c
===================================================================
--- net.orig/drivers/net/ethernet/renesas/sh_eth.c
+++ net/drivers/net/ethernet/renesas/sh_eth.c
@@ -1136,11 +1136,8 @@ static void sh_eth_ring_format(struct ne
break;
sh_eth_set_receive_align(skb);
- /* RX descriptor */
- rxdesc = &mdp->rx_ring[i];
/* The size of the buffer is a multiple of 32 bytes. */
buf_len = ALIGN(mdp->rx_buf_sz, 32);
- rxdesc->len = cpu_to_le32(buf_len << 16);
dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
DMA_FROM_DEVICE);
if (dma_mapping_error(&ndev->dev, dma_addr)) {
@@ -1148,6 +1145,10 @@ static void sh_eth_ring_format(struct ne
break;
}
mdp->rx_skbuff[i] = skb;
+
+ /* RX descriptor */
+ rxdesc = &mdp->rx_ring[i];
+ rxdesc->len = cpu_to_le32(buf_len << 16);
rxdesc->addr = cpu_to_le32(dma_addr);
rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP);
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 0/2] sh_eth: fix couple of bugs in sh_eth_ring_format()
2016-03-07 22:33 [PATCH 0/2] sh_eth: fix couple of bugs in sh_eth_ring_format() Sergei Shtylyov
2016-03-07 22:36 ` [PATCH 1/2] sh_eth: fix NULL pointer dereference " Sergei Shtylyov
2016-03-07 22:37 ` [PATCH 2/2] sh_eth: advance 'rxdesc' later " Sergei Shtylyov
@ 2016-03-10 21:07 ` David Miller
2016-03-10 22:01 ` Sergei Shtylyov
2 siblings, 1 reply; 6+ messages in thread
From: David Miller @ 2016-03-10 21:07 UTC (permalink / raw)
To: sergei.shtylyov; +Cc: netdev, linux-renesas-soc
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Date: Tue, 08 Mar 2016 01:33:38 +0300
> Here's a set of 2 patches against DaveM's 'net.git' repo fixing two bugs
> in sh_eth_.ring_format()...
>
> [1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
> [2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
Since Linus is likely to release today or otherwise very soon I'm not
putting things into 'net'.
So I've applied this series to 'net-next', let me know if I should
queue it up for stable.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] sh_eth: fix couple of bugs in sh_eth_ring_format()
2016-03-10 21:07 ` [PATCH 0/2] sh_eth: fix couple of bugs " David Miller
@ 2016-03-10 22:01 ` Sergei Shtylyov
2016-03-10 22:37 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: Sergei Shtylyov @ 2016-03-10 22:01 UTC (permalink / raw)
To: David Miller; +Cc: netdev, linux-renesas-soc
On 03/11/2016 12:07 AM, David Miller wrote:
>> Here's a set of 2 patches against DaveM's 'net.git' repo fixing two bugs
>> in sh_eth_.ring_format()...
>>
>> [1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
>> [2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
>
> Since Linus is likely to release today or otherwise very soon I'm not
> putting things into 'net'.
>
> So I've applied this series to 'net-next', let me know if I should
> queue it up for stable.
If your generally queue the error path fixes, then queue these two please.
> Thanks.
My pleasure. :-)
MBR, Sergei
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 0/2] sh_eth: fix couple of bugs in sh_eth_ring_format()
2016-03-10 22:01 ` Sergei Shtylyov
@ 2016-03-10 22:37 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2016-03-10 22:37 UTC (permalink / raw)
To: sergei.shtylyov; +Cc: netdev, linux-renesas-soc
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Date: Fri, 11 Mar 2016 01:01:22 +0300
> On 03/11/2016 12:07 AM, David Miller wrote:
>
>>> Here's a set of 2 patches against DaveM's 'net.git' repo fixing two
>>> bugs
>>> in sh_eth_.ring_format()...
>>>
>>> [1/2] sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
>>> [2/2] sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
>>
>> Since Linus is likely to release today or otherwise very soon I'm not
>> putting things into 'net'.
>>
>> So I've applied this series to 'net-next', let me know if I should
>> queue it up for stable.
>
> If your generally queue the error path fixes, then queue these two
> please.
Done.
^ permalink raw reply [flat|nested] 6+ messages in thread