[PATCH net-next 0/4] net: spacemit: A few minor/theoretical fixes

[PATCH net-next 0/4] net: spacemit: A few minor/theoretical fixes

[Vivian Wang]

Recently a user reported a supposed UAF/double-free in this driver. It
turned out to be a false positive (ugh) from a bug with riscv's
kfence_protect_page() [1], but it did also prompt me to review the
driver code yet again. These are some fixes for minor/theoretical
problems I've found.

[1]: https://lore.kernel.org/r/20260303-handle-kfence-protect-spurious-fault-v2-0-f80d8354d79d@iscas.ac.cn/

---
Vivian Wang (4):
      net: spacemit: Remove unused buff_addr fields
      net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()
      net: spacemit: Fix error handling in emac_tx_mem_map()
      net: spacemit: Free rings of memory after unmapping DMA

 drivers/net/ethernet/spacemit/k1_emac.c | 34 ++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)
---
base-commit: 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f
change-id: 20260303-k1-ethernet-more-fixes-1829c3717cfe

Best regards,
-- 
Vivian "dramforever" Wang

[PATCH net-next 1/4] net: spacemit: Remove unused buff_addr fields

[Vivian Wang]

These were never used. Just remove them.

Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
---
 drivers/net/ethernet/spacemit/k1_emac.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/ethernet/spacemit/k1_emac.c b/drivers/net/ethernet/spacemit/k1_emac.c
index 338a2637b1da..af58eae6fcd8 100644
--- a/drivers/net/ethernet/spacemit/k1_emac.c
+++ b/drivers/net/ethernet/spacemit/k1_emac.c
@@ -57,7 +57,6 @@
 
 struct desc_buf {
 	u64 dma_addr;
-	void *buff_addr;
 	u16 dma_len;
 	u8 map_as_page;
 };
@@ -70,7 +69,6 @@ struct emac_tx_desc_buffer {
 struct emac_rx_desc_buffer {
 	struct sk_buff *skb;
 	u64 dma_addr;
-	void *buff_addr;
 	u16 dma_len;
 	u8 map_as_page;
 };
@@ -340,7 +338,6 @@ static void emac_free_tx_buf(struct emac_priv *priv, int i)
 
 		buf->dma_addr = 0;
 		buf->map_as_page = false;
-		buf->buff_addr = NULL;
 	}
 
 	if (tx_buf->skb) {

-- 
2.53.0

[PATCH net-next 2/4] net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()

[Vivian Wang]

Even if we get a dma_mapping_error() while mapping an RX buffer, we
should still update rx_ring->head to ensure that the buffers we were
able to allocate and map are used. Fix this by breaking out to the
existing code after the loop, analogous to the existing handling for skb
allocation failure.

Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
---
 drivers/net/ethernet/spacemit/k1_emac.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/spacemit/k1_emac.c b/drivers/net/ethernet/spacemit/k1_emac.c
index af58eae6fcd8..e9e2cd4e6a89 100644
--- a/drivers/net/ethernet/spacemit/k1_emac.c
+++ b/drivers/net/ethernet/spacemit/k1_emac.c
@@ -562,7 +562,9 @@ static void emac_alloc_rx_desc_buffers(struct emac_priv *priv)
 						  DMA_FROM_DEVICE);
 		if (dma_mapping_error(&priv->pdev->dev, rx_buf->dma_addr)) {
 			dev_err_ratelimited(&ndev->dev, "Mapping skb failed\n");
-			goto err_free_skb;
+			dev_kfree_skb_any(skb);
+			rx_buf->skb = NULL;
+			break;
 		}
 
 		rx_desc_addr = &((struct emac_desc *)rx_ring->desc_addr)[i];
@@ -587,10 +589,6 @@ static void emac_alloc_rx_desc_buffers(struct emac_priv *priv)
 
 	rx_ring->head = i;
 	return;
-
-err_free_skb:
-	dev_kfree_skb_any(skb);
-	rx_buf->skb = NULL;
 }
 
 /* Returns number of packets received */

-- 
2.53.0

[PATCH net-next 3/4] net: spacemit: Fix error handling in emac_tx_mem_map()

[Vivian Wang]

The DMA mappings were leaked on mapping error. Free them with the
existing emac_free_tx_buf() function.

Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
---
 drivers/net/ethernet/spacemit/k1_emac.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/spacemit/k1_emac.c b/drivers/net/ethernet/spacemit/k1_emac.c
index e9e2cd4e6a89..f7f16397a2c2 100644
--- a/drivers/net/ethernet/spacemit/k1_emac.c
+++ b/drivers/net/ethernet/spacemit/k1_emac.c
@@ -730,7 +730,7 @@ static void emac_tx_mem_map(struct emac_priv *priv, struct sk_buff *skb)
 	struct emac_desc tx_desc, *tx_desc_addr;
 	struct device *dev = &priv->pdev->dev;
 	struct emac_tx_desc_buffer *tx_buf;
-	u32 head, old_head, frag_num, f;
+	u32 head, old_head, frag_num, f, i;
 	bool buf_idx;
 
 	frag_num = skb_shinfo(skb)->nr_frags;
@@ -798,6 +798,15 @@ static void emac_tx_mem_map(struct emac_priv *priv, struct sk_buff *skb)
 
 err_free_skb:
 	dev_dstats_tx_dropped(priv->ndev);
+
+	i = old_head;
+	while (i != head) {
+		emac_free_tx_buf(priv, i);
+
+		if (++i == tx_ring->total_cnt)
+			i = 0;
+	}
+
 	dev_kfree_skb_any(skb);
 }
 

-- 
2.53.0

[PATCH net-next 4/4] net: spacemit: Free rings of memory after unmapping DMA

[Vivian Wang]

In emac_free_{tx,rx}_resources, call dma_free_coherent() to unmap DMA
before calling kfree() to deallocate the memory, instead of the other
way around.

Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
---
 drivers/net/ethernet/spacemit/k1_emac.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/spacemit/k1_emac.c b/drivers/net/ethernet/spacemit/k1_emac.c
index f7f16397a2c2..02a009afc921 100644
--- a/drivers/net/ethernet/spacemit/k1_emac.c
+++ b/drivers/net/ethernet/spacemit/k1_emac.c
@@ -446,12 +446,12 @@ static void emac_free_tx_resources(struct emac_priv *priv)
 
 	emac_clean_tx_desc_ring(priv);
 
-	kfree(tr->tx_desc_buf);
-	tr->tx_desc_buf = NULL;
-
 	dma_free_coherent(dev, tr->total_size, tr->desc_addr,
 			  tr->desc_dma_addr);
 	tr->desc_addr = NULL;
+
+	kfree(tr->tx_desc_buf);
+	tr->tx_desc_buf = NULL;
 }
 
 static void emac_free_rx_resources(struct emac_priv *priv)
@@ -461,12 +461,12 @@ static void emac_free_rx_resources(struct emac_priv *priv)
 
 	emac_clean_rx_desc_ring(priv);
 
-	kfree(rr->rx_desc_buf);
-	rr->rx_desc_buf = NULL;
-
 	dma_free_coherent(dev, rr->total_size, rr->desc_addr,
 			  rr->desc_dma_addr);
 	rr->desc_addr = NULL;
+
+	kfree(rr->rx_desc_buf);
+	rr->rx_desc_buf = NULL;
 }
 
 static int emac_tx_clean_desc(struct emac_priv *priv)

-- 
2.53.0

Re: [PATCH net-next 1/4] net: spacemit: Remove unused buff_addr fields

[Andrew Lunn]

On Tue, Mar 03, 2026 at 05:24:18PM +0800, Vivian Wang wrote:
> These were never used. Just remove them.
> 
> Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")

If you are giving a Fixes: tag, please use the net tree, not net-next.

    Andrew

---
pw-bot: cr

Re: [PATCH net-next 1/4] net: spacemit: Remove unused buff_addr fields

[Jakub Kicinski]

On Wed, 4 Mar 2026 21:57:57 +0100 Andrew Lunn wrote:
> On Tue, Mar 03, 2026 at 05:24:18PM +0800, Vivian Wang wrote:
> > These were never used. Just remove them.
> > 
> > Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")  
> 
> If you are giving a Fixes: tag, please use the net tree, not net-next.

Maybe rephrasing what Andrew said slightly - please read
https://www.kernel.org/doc/html/next/process/maintainer-netdev.html
and general documentation about Fixes tags. The tags mean there is
a bug which may be impacting users.

Re: [PATCH net-next 1/4] net: spacemit: Remove unused buff_addr fields

[Vivian Wang]

On 3/5/26 06:05, Jakub Kicinski wrote:
> On Wed, 4 Mar 2026 21:57:57 +0100 Andrew Lunn wrote:
>> On Tue, Mar 03, 2026 at 05:24:18PM +0800, Vivian Wang wrote:
>>> These were never used. Just remove them.
>>>
>>> Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")  
>> If you are giving a Fixes: tag, please use the net tree, not net-next.
> Maybe rephrasing what Andrew said slightly - please read
> https://www.kernel.org/doc/html/next/process/maintainer-netdev.html
> and general documentation about Fixes tags. The tags mean there is
> a bug which may be impacting users.

Sorry for misunderstanding this. I'll fix it in v2.

Vivian "dramforever" Wang