Messages in this thread Patch in this message | | | From | Jonas Suhr Christensen <> | Subject | [PATCH 1/2] net: ll_temac: fix DMA resources leak | Date | Thu, 26 Jan 2023 11:16:06 +0100 |
| |
Add missing conversion of address when unmapping dma region causing unmapping to silently fail. At some point resulting in buffer overrun eg. when releasing device.
Signed-off-by: Jonas Suhr Christensen <jsc@umbraculum.org> --- drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c index 1066420d6a83..66c04027f230 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -300,6 +300,7 @@ static void temac_dma_bd_release(struct net_device *ndev) { struct temac_local *lp = netdev_priv(ndev); int i; + struct cdmac_bd *bd; /* Reset Local Link (DMA) */ lp->dma_out(lp, DMA_CONTROL_REG, DMA_CONTROL_RST); @@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev) for (i = 0; i < lp->rx_bd_num; i++) { if (!lp->rx_skb[i]) break; - dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys, + + bd = &lp->rx_bd_v[1]; + dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys), XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE); + bd->phys = 0; + bd->len = 0; dev_kfree_skb(lp->rx_skb[i]); + lp->rx_skb[i] = NULL; } if (lp->rx_bd_v) dma_free_coherent(ndev->dev.parent, -- 2.39.1
| |