Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1295212 > unrolled thread

[PATCH] natsemi: add checks for dma mapping errors

Started byAlexey Khoroshilov <khoroshilov@ispras.ru>
First post2015-12-18 23:00 +0100
Last post2015-12-19 19:00 +0100
Articles 6 — 2 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH] natsemi: add checks for dma mapping errors Alexey Khoroshilov <khoroshilov@ispras.ru> - 2015-12-18 23:00 +0100
    Re: [PATCH] natsemi: add checks for dma mapping errors David Miller <davem@davemloft.net> - 2015-12-19 03:40 +0100
      Re: [PATCH] natsemi: add checks for dma mapping errors Alexey Khoroshilov <khoroshilov@ispras.ru> - 2015-12-19 13:10 +0100
        [PATCH v2] natsemi: add checks for dma mapping errors Alexey Khoroshilov <khoroshilov@ispras.ru> - 2015-12-19 13:20 +0100
          Re: [PATCH v2] natsemi: add checks for dma mapping errors David Miller <davem@davemloft.net> - 2015-12-19 19:00 +0100
        Re: [PATCH] natsemi: add checks for dma mapping errors David Miller <davem@davemloft.net> - 2015-12-19 19:00 +0100

#1295212 — [PATCH] natsemi: add checks for dma mapping errors

FromAlexey Khoroshilov <khoroshilov@ispras.ru>
Date2015-12-18 23:00 +0100
Subject[PATCH] natsemi: add checks for dma mapping errors
Message-ID<qHbe9-2K9-7@gated-at.bofh.it>
refill_rx() and start_tx() do not check if mapping dma memory succeed.
The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 drivers/net/ethernet/natsemi/natsemi.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index b83f7c0fcf99..282e59d66a52 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -1937,6 +1937,12 @@ static void refill_rx(struct net_device *dev)
 				break; /* Better luck next round. */
 			np->rx_dma[entry] = pci_map_single(np->pci_dev,
 				skb->data, buflen, PCI_DMA_FROMDEVICE);
+			if (pci_dma_mapping_error(np->pci_dev,
+						  np->rx_dma[entry])) {
+				dev_kfree_skb_any(skb);
+				np->rx_skbuff[entry] = NULL;
+				break; /* Better luck next round. */
+			}
 			np->rx_ring[entry].addr = cpu_to_le32(np->rx_dma[entry]);
 		}
 		np->rx_ring[entry].cmd_status = cpu_to_le32(np->rx_buf_sz);
@@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
 	np->tx_skbuff[entry] = skb;
 	np->tx_dma[entry] = pci_map_single(np->pci_dev,
 				skb->data,skb->len, PCI_DMA_TODEVICE);
+	if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
+		np->tx_skbuff[entry] = NULL;
+		return NETDEV_TX_BUSY;
+	}
 
 	np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1295271

FromDavid Miller <davem@davemloft.net>
Date2015-12-19 03:40 +0100
Message-ID<qHfB8-5yW-7@gated-at.bofh.it>
In reply to#1295212
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sat, 19 Dec 2015 00:55:37 +0300

> @@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
>  	np->tx_skbuff[entry] = skb;
>  	np->tx_dma[entry] = pci_map_single(np->pci_dev,
>  				skb->data,skb->len, PCI_DMA_TODEVICE);
> +	if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
> +		np->tx_skbuff[entry] = NULL;
> +		return NETDEV_TX_BUSY;
> +	}
>  
>  	np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
>  

Returning NETDEV_TX_BUSY and freeing the SKB will crash the system.

NETDEV_TX_BUSY is only for buggy drivers that do not manage their
TX ring busy condition correctly, and thus need retries.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1295368

FromAlexey Khoroshilov <khoroshilov@ispras.ru>
Date2015-12-19 13:10 +0100
Message-ID<qHouJ-30u-7@gated-at.bofh.it>
In reply to#1295271
On 19.12.2015 05:36, David Miller wrote:
> From: Alexey Khoroshilov <khoroshilov@ispras.ru>
> Date: Sat, 19 Dec 2015 00:55:37 +0300
>
>> @@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff
*skb, struct net_device *dev)
>>  	np->tx_skbuff[entry] = skb;
>>  	np->tx_dma[entry] = pci_map_single(np->pci_dev,
>>  				skb->data,skb->len, PCI_DMA_TODEVICE);
>> +	if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
>> +		np->tx_skbuff[entry] = NULL;
>> +		return NETDEV_TX_BUSY;
>> +	}
>>
>>  	np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
>>
>
> Returning NETDEV_TX_BUSY and freeing the SKB will crash the system.

I do not quite understand what do you mean by 'freeing the SKB'.
At least the patch left skb untouched.

But I saw such pattern, for example, in
drivers/net/ethernet/freescale/fec_main.c:

	addr = dma_map_single(&fep->pdev->dev, data, size, DMA_TO_DEVICE);
	if (dma_mapping_error(&fep->pdev->dev, addr)) {
		dev_kfree_skb_any(skb);
		if (net_ratelimit())
			netdev_err(ndev, "Tx DMA memory map failed\n");
		return NETDEV_TX_BUSY;
	}

>
> NETDEV_TX_BUSY is only for buggy drivers that do not manage their
> TX ring busy condition correctly, and thus need retries.

Ok, I will replace NETDEV_TX_BUSY by dropping the packet.

--
Alexey

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1295369 — [PATCH v2] natsemi: add checks for dma mapping errors

FromAlexey Khoroshilov <khoroshilov@ispras.ru>
Date2015-12-19 13:20 +0100
Subject[PATCH v2] natsemi: add checks for dma mapping errors
Message-ID<qHoEp-33W-5@gated-at.bofh.it>
In reply to#1295368
refill_rx() and start_tx() do not check if mapping dma memory succeed.
The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 drivers/net/ethernet/natsemi/natsemi.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index b83f7c0fcf99..122c2ee3dfe2 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -1937,6 +1937,12 @@ static void refill_rx(struct net_device *dev)
 				break; /* Better luck next round. */
 			np->rx_dma[entry] = pci_map_single(np->pci_dev,
 				skb->data, buflen, PCI_DMA_FROMDEVICE);
+			if (pci_dma_mapping_error(np->pci_dev,
+						  np->rx_dma[entry])) {
+				dev_kfree_skb_any(skb);
+				np->rx_skbuff[entry] = NULL;
+				break; /* Better luck next round. */
+			}
 			np->rx_ring[entry].addr = cpu_to_le32(np->rx_dma[entry]);
 		}
 		np->rx_ring[entry].cmd_status = cpu_to_le32(np->rx_buf_sz);
@@ -2093,6 +2099,12 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
 	np->tx_skbuff[entry] = skb;
 	np->tx_dma[entry] = pci_map_single(np->pci_dev,
 				skb->data,skb->len, PCI_DMA_TODEVICE);
+	if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
+		np->tx_skbuff[entry] = NULL;
+		dev_kfree_skb_irq(skb);
+		dev->stats.tx_dropped++;
+		return NETDEV_TX_OK;
+	}
 
 	np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1295426 — Re: [PATCH v2] natsemi: add checks for dma mapping errors

FromDavid Miller <davem@davemloft.net>
Date2015-12-19 19:00 +0100
SubjectRe: [PATCH v2] natsemi: add checks for dma mapping errors
Message-ID<qHtXs-6gO-7@gated-at.bofh.it>
In reply to#1295369
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sat, 19 Dec 2015 15:13:49 +0300

> refill_rx() and start_tx() do not check if mapping dma memory succeed.
> The patch adds the checks and failure handling.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1295425

FromDavid Miller <davem@davemloft.net>
Date2015-12-19 19:00 +0100
Message-ID<qHtXs-6gO-1@gated-at.bofh.it>
In reply to#1295368
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sat, 19 Dec 2015 15:06:45 +0300

> On 19.12.2015 05:36, David Miller wrote:
>> From: Alexey Khoroshilov <khoroshilov@ispras.ru>
>> Date: Sat, 19 Dec 2015 00:55:37 +0300
>>
>>> @@ -2093,6 +2099,10 @@ static netdev_tx_t start_tx(struct sk_buff
> *skb, struct net_device *dev)
>>>  	np->tx_skbuff[entry] = skb;
>>>  	np->tx_dma[entry] = pci_map_single(np->pci_dev,
>>>  				skb->data,skb->len, PCI_DMA_TODEVICE);
>>> +	if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
>>> +		np->tx_skbuff[entry] = NULL;
>>> +		return NETDEV_TX_BUSY;
>>> +	}
>>>
>>>  	np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
>>>
>>
>> Returning NETDEV_TX_BUSY and freeing the SKB will crash the system.
> 
> I do not quite understand what do you mean by 'freeing the SKB'.
> At least the patch left skb untouched.

Sorry, I misread your patch, I thought I saw a kfree there but
obviously there isn't.

>> NETDEV_TX_BUSY is only for buggy drivers that do not manage their
>> TX ring busy condition correctly, and thus need retries.
> 
> Ok, I will replace NETDEV_TX_BUSY by dropping the packet.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web