Re: [PATCH net-next 2/2] net: atlantic: convert RX path to page_pool

[Paolo Abeni <pabeni@redhat.com>]

On 7/10/26 7:38 PM, sashiko-bot@kernel.org wrote:
>> +		return -ENOMEM;
>> +	}
>>  
>> -	if (!rxbuf->rxdata.page) {
>> -		ret = aq_alloc_rxpages(&rxbuf->rxdata, self);
>> -		if (ret) {
>> -			u64_stats_update_begin(&self->stats.rx.syncp);
>> -			self->stats.rx.alloc_fails++;
>> -			u64_stats_update_end(&self->stats.rx.syncp);
>> -		}
>> -		return ret;
>> -	}
>> +	rxbuf->rxdata.page = page;
>> +	rxbuf->rxdata.daddr = page_pool_get_dma_addr(page);
>> +	rxbuf->rxdata.pg_off = pg_off + self->page_offset;
> 
> [Severity: Critical]
> Can this cause severe DMA memory corruption during RX buffer refill?
> 
> The initialization of buff->pa appears to be missing or was removed here,
> but the hardware callback still executes immediately after and
> unconditionally overwrites the descriptor's physical address:
> 
> hw_atl_b0_hw_ring_rx_fill() {
>     ...
>     rxd->buf_addr = buff->pa;
>     rxd->hdr_addr = 0U;
>     ...
> }

FTR, AFAICS the above is AI sloop (and quite an unexpected one!) as
buff->pa is actually always initialized by:

	buff->pa = aq_buf_daddr(&buff->rxdata);

that comes after the aq_get_rxpages() call. All other issues are
pre-existing ones.

/P