From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pdx-out-004.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-004.esa.us-west-2.outbound.mail-perimeter.amazon.com [44.246.77.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 526717DA66; Mon, 16 Mar 2026 19:32:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=44.246.77.92 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773689527; cv=none; b=Ypnby8Q7HiPUtWVT/iuLNMSf+Y4kBgm0v+JLW+C1HwLIe8YQrOZYZp8vrfq6XzMGlh9v8u5d1EHFGGDBwxz/dwt5QLFkqMlEBIjO1e7JwdZkgjAWhpdsUc9+H04qgK9XPuKwDXQthrBuLthJ4n886LyJ3LMgwxZLKOAMG9m73Yw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773689527; c=relaxed/simple; bh=bXGIvtLZW4T8uQHwrxZgF5OdXg/Br/wvKn4OcYtILOA=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=PBb75ejuTwhyuzfc1OUiYeVX+zzjhWNWye9YjbSUpY7yTfjx2jV+7ulQZLnMdQ8BGlLg+kB4MPRB5Ga8VyVDG18BCO2ZLhR9WnfKKySQ53pNjsFuQ5N1x5WfBQJuXKo4+xCGW2GEN5A3y78YFjZKMPpFz3fYzfjNlNnMQDyHix4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.com; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=aVxk91BJ; arc=none smtp.client-ip=44.246.77.92 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="aVxk91BJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1773689526; x=1805225526; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=hhknY0Mb6RUOEmemmsi44lfiShqeiitZKXcXHjSjtK0=; b=aVxk91BJEuCz8OFcS55JYZMH9aPJ55vGzIu7jpLDAvQ03p2NzR3njVAh ZOAakMMwoUFTRUY3LlnzMnZufaOJc9mdnzTml44nfyHW+d6bWPybeBKZN 0CUJ2edYwvmjuradUiivY9tT3QyxPqGKoZ55tUIPIHfvGKyzfBEn/D0cJ K/9plj7xei7aMJkFHd0mPQ+xrco0vay3XkbRMcAvp3L8gXMEivdKhGtrs RR3jMBQeo3x+U90Uz234BMJ3iQfeEZvSxMCgcx5eyVMC7uO2WMXFd67ud nO1EecnY1SVx5cXiZrxAIkLiURi3dttt8CkwKx/BmFGVvvSfCNmVhyE+p A==; X-CSE-ConnectionGUID: +GeasfBxRc6TOMCohlqAMg== X-CSE-MsgGUID: NLdedqH5Sp2zGQnXizKt6Q== X-IronPort-AV: E=Sophos;i="6.23,124,1770595200"; d="scan'208";a="15141234" Received: from ip-10-5-6-203.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.6.203]) by internal-pdx-out-004.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Mar 2026 19:32:05 +0000 Received: from EX19MTAUWC001.ant.amazon.com [205.251.233.105:18209] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.19.27:2525] with esmtp (Farcaster) id 293eb4bd-c085-4413-8129-6fd28858c630; Mon, 16 Mar 2026 19:32:05 +0000 (UTC) X-Farcaster-Flow-ID: 293eb4bd-c085-4413-8129-6fd28858c630 Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWC001.ant.amazon.com (10.250.64.174) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Mon, 16 Mar 2026 19:32:04 +0000 Received: from 842f577f6371.amazon.com (10.106.101.53) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Mon, 16 Mar 2026 19:32:03 +0000 From: Muhammad Hammad Ijaz To: , , , , , , , , CC: , , Subject: [PATCH] net: mvpp2: guard flow control update with global_tx_fc in buffer switching Date: Mon, 16 Mar 2026 12:31:01 -0700 Message-ID: <20260316193157.65748-1-mhijaz@amazon.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EX19D036UWB001.ant.amazon.com (10.13.139.133) To EX19D001UWA001.ant.amazon.com (10.13.138.214) mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference priv->cm3_base without any NULL check. When the CM3 SRAM resource is not present in the device tree (the third reg entry added by commit 60523583b07c ("dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains NULL and priv->global_tx_fc is false. Any operation that triggers mvpp2_bm_switch_buffers(), for example an MTU change that crosses the jumbo frame threshold, will crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits pc : readl+0x0/0x18 lr : mvpp2_cm3_read.isra.0+0x14/0x20 Call trace: readl+0x0/0x18 mvpp2_bm_pool_update_fc+0x40/0x12c mvpp2_bm_pool_update_priv_fc+0x94/0xd8 mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0 mvpp2_change_mtu+0x140/0x380 __dev_set_mtu+0x1c/0x38 dev_set_mtu_ext+0x78/0x118 dev_set_mtu+0x48/0xa8 dev_ifsioc+0x21c/0x43c dev_ioctl+0x2d8/0x42c sock_ioctl+0x314/0x378 Every other flow control call site in the driver already guards hardware access with either priv->global_tx_fc or port->tx_fc. mvpp2_bm_switch_buffers() is the only place that omits this check. Add the missing priv->global_tx_fc guard to both the disable and re-enable calls in mvpp2_bm_switch_buffers(), consistent with the rest of the driver. Fixes: 3a616b92a9d1 ("net: mvpp2: Add TX flow control support for jumbo frames") Signed-off-by: Muhammad Hammad Ijaz Reviewed-by: Gunnar Kudrjavets --- Testing: - Tested on Marvell Armada 7040 board without CM3 SRAM in device tree - Without the fix, MTU change triggers a NULL pointer dereference in mvpp2_cm3_read() - With the fix, MTU change completes successfully --- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index d1b8650cb4b4..f442b874bb59 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -5016,7 +5016,7 @@ static int mvpp2_bm_switch_buffers(struct mvpp2 *priv, bool percpu) if (priv->percpu_pools) numbufs = port->nrxqs * 2; - if (change_percpu) + if (change_percpu && priv->global_tx_fc) mvpp2_bm_pool_update_priv_fc(priv, false); for (i = 0; i < numbufs; i++) @@ -5041,7 +5041,7 @@ static int mvpp2_bm_switch_buffers(struct mvpp2 *priv, bool percpu) mvpp2_open(port->dev); } - if (change_percpu) + if (change_percpu && priv->global_tx_fc) mvpp2_bm_pool_update_priv_fc(priv, true); return 0; -- 2.53.0