* [PATCH] natsemi: add checks for dma mapping errors
@ 2015-12-18 21:55 Alexey Khoroshilov
2015-12-19 2:36 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: Alexey Khoroshilov @ 2015-12-18 21:55 UTC (permalink / raw)
To: David S . Miller; +Cc: Alexey Khoroshilov, netdev, linux-kernel, ldv-project
refill_rx() and start_tx() do not check if mapping dma memory succeed.
The patch adds the checks and failure handling.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/net/ethernet/natsemi/natsemi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index b83f7c0fcf99..282e59d66a52 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -1937,6 +1937,12 @@ static void refill_rx(struct net_device *dev)
break; /* Better luck next round. */
np->rx_dma[entry] = pci_map_single(np->pci_dev,
skb->data, buflen, PCI_DMA_FROMDEVICE);
+ if (pci_dma_mapping_error(np->pci_dev,
+ np->rx_dma[entry])) {
+ dev_kfree_skb_any(skb);
+ np->rx_skbuff[entry] = NULL;
+ break; /* Better luck next round. */
+ }
np->rx_ring[entry].addr = cpu_to_le32(np->rx_dma[entry]);
}
np->rx_ring[entry].cmd_status = cpu_to_le32(np->rx_buf_sz);
@@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
np->tx_skbuff[entry] = skb;
np->tx_dma[entry] = pci_map_single(np->pci_dev,
skb->data,skb->len, PCI_DMA_TODEVICE);
+ if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
+ np->tx_skbuff[entry] = NULL;
+ return NETDEV_TX_BUSY;
+ }
np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] natsemi: add checks for dma mapping errors
2015-12-18 21:55 [PATCH] natsemi: add checks for dma mapping errors Alexey Khoroshilov
@ 2015-12-19 2:36 ` David Miller
2015-12-19 12:06 ` Alexey Khoroshilov
0 siblings, 1 reply; 6+ messages in thread
From: David Miller @ 2015-12-19 2:36 UTC (permalink / raw)
To: khoroshilov; +Cc: netdev, linux-kernel, ldv-project
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sat, 19 Dec 2015 00:55:37 +0300
> @@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
> np->tx_skbuff[entry] = skb;
> np->tx_dma[entry] = pci_map_single(np->pci_dev,
> skb->data,skb->len, PCI_DMA_TODEVICE);
> + if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
> + np->tx_skbuff[entry] = NULL;
> + return NETDEV_TX_BUSY;
> + }
>
> np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
>
Returning NETDEV_TX_BUSY and freeing the SKB will crash the system.
NETDEV_TX_BUSY is only for buggy drivers that do not manage their
TX ring busy condition correctly, and thus need retries.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] natsemi: add checks for dma mapping errors
2015-12-19 2:36 ` David Miller
@ 2015-12-19 12:06 ` Alexey Khoroshilov
2015-12-19 12:13 ` [PATCH v2] " Alexey Khoroshilov
2015-12-19 17:54 ` [PATCH] " David Miller
0 siblings, 2 replies; 6+ messages in thread
From: Alexey Khoroshilov @ 2015-12-19 12:06 UTC (permalink / raw)
To: David Miller; +Cc: netdev, linux-kernel, ldv-project
On 19.12.2015 05:36, David Miller wrote:
> From: Alexey Khoroshilov <khoroshilov@ispras.ru>
> Date: Sat, 19 Dec 2015 00:55:37 +0300
>
>> @@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff
*skb, struct net_device *dev)
>> np->tx_skbuff[entry] = skb;
>> np->tx_dma[entry] = pci_map_single(np->pci_dev,
>> skb->data,skb->len, PCI_DMA_TODEVICE);
>> + if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
>> + np->tx_skbuff[entry] = NULL;
>> + return NETDEV_TX_BUSY;
>> + }
>>
>> np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
>>
>
> Returning NETDEV_TX_BUSY and freeing the SKB will crash the system.
I do not quite understand what do you mean by 'freeing the SKB'.
At least the patch left skb untouched.
But I saw such pattern, for example, in
drivers/net/ethernet/freescale/fec_main.c:
addr = dma_map_single(&fep->pdev->dev, data, size, DMA_TO_DEVICE);
if (dma_mapping_error(&fep->pdev->dev, addr)) {
dev_kfree_skb_any(skb);
if (net_ratelimit())
netdev_err(ndev, "Tx DMA memory map failed\n");
return NETDEV_TX_BUSY;
}
>
> NETDEV_TX_BUSY is only for buggy drivers that do not manage their
> TX ring busy condition correctly, and thus need retries.
Ok, I will replace NETDEV_TX_BUSY by dropping the packet.
--
Alexey
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v2] natsemi: add checks for dma mapping errors
2015-12-19 12:06 ` Alexey Khoroshilov
@ 2015-12-19 12:13 ` Alexey Khoroshilov
2015-12-19 17:59 ` David Miller
2015-12-19 17:54 ` [PATCH] " David Miller
1 sibling, 1 reply; 6+ messages in thread
From: Alexey Khoroshilov @ 2015-12-19 12:13 UTC (permalink / raw)
To: David S . Miller; +Cc: Alexey Khoroshilov, netdev, linux-kernel, ldv-project
refill_rx() and start_tx() do not check if mapping dma memory succeed.
The patch adds the checks and failure handling.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/net/ethernet/natsemi/natsemi.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index b83f7c0fcf99..122c2ee3dfe2 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -1937,6 +1937,12 @@ static void refill_rx(struct net_device *dev)
break; /* Better luck next round. */
np->rx_dma[entry] = pci_map_single(np->pci_dev,
skb->data, buflen, PCI_DMA_FROMDEVICE);
+ if (pci_dma_mapping_error(np->pci_dev,
+ np->rx_dma[entry])) {
+ dev_kfree_skb_any(skb);
+ np->rx_skbuff[entry] = NULL;
+ break; /* Better luck next round. */
+ }
np->rx_ring[entry].addr = cpu_to_le32(np->rx_dma[entry]);
}
np->rx_ring[entry].cmd_status = cpu_to_le32(np->rx_buf_sz);
@@ -2093,6 +2099,12 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
np->tx_skbuff[entry] = skb;
np->tx_dma[entry] = pci_map_single(np->pci_dev,
skb->data,skb->len, PCI_DMA_TODEVICE);
+ if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
+ np->tx_skbuff[entry] = NULL;
+ dev_kfree_skb_irq(skb);
+ dev->stats.tx_dropped++;
+ return NETDEV_TX_OK;
+ }
np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2] natsemi: add checks for dma mapping errors
2015-12-19 12:13 ` [PATCH v2] " Alexey Khoroshilov
@ 2015-12-19 17:59 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2015-12-19 17:59 UTC (permalink / raw)
To: khoroshilov; +Cc: netdev, linux-kernel, ldv-project
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sat, 19 Dec 2015 15:13:49 +0300
> refill_rx() and start_tx() do not check if mapping dma memory succeed.
> The patch adds the checks and failure handling.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] natsemi: add checks for dma mapping errors
2015-12-19 12:06 ` Alexey Khoroshilov
2015-12-19 12:13 ` [PATCH v2] " Alexey Khoroshilov
@ 2015-12-19 17:54 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: David Miller @ 2015-12-19 17:54 UTC (permalink / raw)
To: khoroshilov; +Cc: netdev, linux-kernel, ldv-project
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sat, 19 Dec 2015 15:06:45 +0300
> On 19.12.2015 05:36, David Miller wrote:
>> From: Alexey Khoroshilov <khoroshilov@ispras.ru>
>> Date: Sat, 19 Dec 2015 00:55:37 +0300
>>
>>> @@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff
> *skb, struct net_device *dev)
>>> np->tx_skbuff[entry] = skb;
>>> np->tx_dma[entry] = pci_map_single(np->pci_dev,
>>> skb->data,skb->len, PCI_DMA_TODEVICE);
>>> + if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
>>> + np->tx_skbuff[entry] = NULL;
>>> + return NETDEV_TX_BUSY;
>>> + }
>>>
>>> np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
>>>
>>
>> Returning NETDEV_TX_BUSY and freeing the SKB will crash the system.
>
> I do not quite understand what do you mean by 'freeing the SKB'.
> At least the patch left skb untouched.
Sorry, I misread your patch, I thought I saw a kfree there but
obviously there isn't.
>> NETDEV_TX_BUSY is only for buggy drivers that do not manage their
>> TX ring busy condition correctly, and thus need retries.
>
> Ok, I will replace NETDEV_TX_BUSY by dropping the packet.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-12-19 17:59 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-12-18 21:55 [PATCH] natsemi: add checks for dma mapping errors Alexey Khoroshilov
2015-12-19 2:36 ` David Miller
2015-12-19 12:06 ` Alexey Khoroshilov
2015-12-19 12:13 ` [PATCH v2] " Alexey Khoroshilov
2015-12-19 17:59 ` David Miller
2015-12-19 17:54 ` [PATCH] " David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).