netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 5.10 01/54] mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
@ 2021-03-17  0:56 Sasha Levin
  2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 02/54] net: stmmac: fix dma physical address of descriptor when display ring Sasha Levin
                   ` (15 more replies)
  0 siblings, 16 replies; 17+ messages in thread
From: Sasha Levin @ 2021-03-17  0:56 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Felix Fietkau, Kalle Valo, Sasha Levin, linux-wireless, netdev,
	linux-arm-kernel, linux-mediatek

From: Felix Fietkau <nbd@nbd.name>

[ Upstream commit ae064fc0e32a4d28389086d9f4b260a0c157cfee ]

When running out of room in the tx queue after calling drv->tx_prepare_skb,
the buffer list will already have been modified on MT7615 and newer drivers.
This can leak a DMA mapping and will show up as swiotlb allocation failures
on x86.

Fix this by moving the queue length check further up. This is less accurate,
since it can overestimate the needed room in the queue on MT7615 and newer,
but the difference is small enough to not matter in practice.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210216135119.23809-1-nbd@nbd.name
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 917617aad8d3..3857761c9619 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -355,7 +355,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
 	};
 	struct ieee80211_hw *hw;
 	int len, n = 0, ret = -ENOMEM;
-	struct mt76_queue_entry e;
 	struct mt76_txwi_cache *t;
 	struct sk_buff *iter;
 	dma_addr_t addr;
@@ -397,6 +396,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
 	}
 	tx_info.nbuf = n;
 
+	if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
+		ret = -ENOMEM;
+		goto unmap;
+	}
+
 	dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size,
 				DMA_TO_DEVICE);
 	ret = dev->drv->tx_prepare_skb(dev, txwi, qid, wcid, sta, &tx_info);
@@ -405,11 +409,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
 	if (ret < 0)
 		goto unmap;
 
-	if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
-		ret = -ENOMEM;
-		goto unmap;
-	}
-
 	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
 				tx_info.info, tx_info.skb, t);
 
@@ -425,9 +424,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
 		dev->test.tx_done--;
 #endif
 
-	e.skb = tx_info.skb;
-	e.txwi = t;
-	dev->drv->tx_complete_skb(dev, &e);
+	dev_kfree_skb(tx_info.skb);
 	mt76_put_txwi(dev, t);
 	return ret;
 }
-- 
2.30.1


^ permalink raw reply related	[flat|nested] 17+ messages in thread
end of thread, other threads:[~2021-03-17  0:59 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-03-17  0:56 [PATCH AUTOSEL 5.10 01/54] mt76: fix tx skb error handling in mt76_dma_tx_queue_skb Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 02/54] net: stmmac: fix dma physical address of descriptor when display ring Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 03/54] net: fec: ptp: avoid register access when ipg clock is disabled Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 05/54] atm: eni: dont release is never initialized Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 06/54] atm: lanai: dont run lanai_dev_close if not open Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 07/54] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 09/54] ixgbe: Fix memleak in ixgbe_configure_clsu32 Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 12/54] net: tehuti: fix error return code in bdx_probe() Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 13/54] net: intel: iavf: fix error return code of iavf_init_get_resources() Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 14/54] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 15/54] gianfar: fix jumbo packets+napi+rx overrun crash Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 22/54] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 23/54] net: wan: fix error return code of uhdlc_init() Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 24/54] net: davicom: Use platform_get_irq_optional() Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 25/54] net: enetc: set MAC RX FIFO to recommended value Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 26/54] atm: uPD98402: fix incorrect allocation Sasha Levin
2021-03-17  0:56 ` [PATCH AUTOSEL 5.10 27/54] atm: idt77252: fix null-ptr-dereference Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).