lkml.org 
[lkml]   [2023]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/2] net: ll_temac: fix DMA resources leak
From
Le 26/01/2023 à 11:16, Jonas Suhr Christensen a écrit :
> Add missing conversion of address when unmapping dma region causing
> unmapping to silently fail. At some point resulting in buffer
> overrun eg. when releasing device.
>
> Signed-off-by: Jonas Suhr Christensen <jsc@umbraculum.org>
> ---
> drivers/net/ethernet/xilinx/ll_temac_main.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
> index 1066420d6a83..66c04027f230 100644
> --- a/drivers/net/ethernet/xilinx/ll_temac_main.c
> +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
> @@ -300,6 +300,7 @@ static void temac_dma_bd_release(struct net_device *ndev)
> {
> struct temac_local *lp = netdev_priv(ndev);
> int i;
> + struct cdmac_bd *bd;
>
> /* Reset Local Link (DMA) */
> lp->dma_out(lp, DMA_CONTROL_REG, DMA_CONTROL_RST);
> @@ -307,9 +308,14 @@ static void temac_dma_bd_release(struct net_device *ndev)
> for (i = 0; i < lp->rx_bd_num; i++) {
> if (!lp->rx_skb[i])
> break;
> - dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys,
> +
> + bd = &lp->rx_bd_v[1];

Hi,
just a naive question from s.o. who knows nothing of this code:

Is really [1] ([one]) expected here?
[i] would look more "standard" in a 'for' loop.

just my 2c,

CJ


> + dma_unmap_single(ndev->dev.parent, be32_to_cpu(bd->phys),
> XTE_MAX_JUMBO_FRAME_SIZE, DMA_FROM_DEVICE);
> + bd->phys = 0;
> + bd->len = 0;
> dev_kfree_skb(lp->rx_skb[i]);
> + lp->rx_skb[i] = NULL;
> }
> if (lp->rx_bd_v)
> dma_free_coherent(ndev->dev.parent,

\
 
 \ /
  Last update: 2023-03-27 00:02    [W:0.099 / U:0.196 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site