mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-05-26 11:40:24 +02:00
Wei Fang
3cade69888
The AI-generated review reported a potential DMA use-after-free issue
[1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending
command is not explicitly aborted, while ntmp_free_data_mem()
unconditionally frees the DMA buffer. If the buffer has already been
reallocated elsewhere, this may lead to silent memory corruption. Because
the hardware eventually processes the pending command and perform a DMA
write of the response to the physical address of the freed buffer.
To resolve this issue, this patch does the following modifications:
1. Convert cbdr->ring_lock from a spinlock to a mutex
The lock was originally a spinlock in case NTMP operations might be
invoked from atomic context. After downstream support for all NTMP
tables, no such usage has materialized. A mutex lock is now required
because the driver now needs to reclaim used BDs and release associated
DMA memory within the lock's context, while dma_free_coherent() might
sleep.
2. Introduce software command BD (struct netc_swcbd)
The hardware write-back overwrites the addr and len fields of the BD,
so the driver cannot rely on the hardware BD to free the associated DMA
memory. The driver now maintains a software shadow BD storing the DMA
buffer pointer, DMA address, and size. And netc_xmit_ntmp_cmd() only
reclaims older BDs when the number of used BDs reaches
NETC_CBDR_CLEAN_WORK (16). The software BD enables correct DMA memory
release. With this, struct ntmp_dma_buf and ntmp_free_data_mem() are no
longer needed and are removed.
3. Require callers to hold ring_lock across netc_xmit_ntmp_cmd()
netc_xmit_ntmp_cmd() releases the ring_lock before the caller finishes
consuming the response. At this point, if a concurrent thread submits
a new command, it may trigger ntmp_clean_cbdr() and free the DMA buffer
while it is still in use. Move ring_lock ownership to the caller to
ensure the response buffer cannot be reclaimed prematurely. So the
helpers ntmp_select_and_lock_cbdr() and ntmp_unlock_cbdr() are added.
These changes eliminate the DMA use-after-free condition and ensure safe
and consistent BD reclamation and DMA buffer lifecycle management.
Fixes: 4701073c3d ("net: enetc: add initial netc-lib driver to support NTMP")
Link: https://lore.kernel.org/netdev/20260403011729.1795413-1-kuba@kernel.org/ # [1]
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20260415060833.2303846-3-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
129 lines
2.5 KiB
C
129 lines
2.5 KiB
C
/* SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause) */
|
|
/* Copyright 2025 NXP */
|
|
#ifndef __NETC_NTMP_H
|
|
#define __NETC_NTMP_H
|
|
|
|
#include <linux/bitops.h>
|
|
#include <linux/if_ether.h>
|
|
|
|
struct maft_keye_data {
|
|
u8 mac_addr[ETH_ALEN];
|
|
__le16 resv;
|
|
};
|
|
|
|
struct maft_cfge_data {
|
|
__le16 si_bitmap;
|
|
__le16 resv;
|
|
};
|
|
|
|
struct netc_cbdr_regs {
|
|
void __iomem *pir;
|
|
void __iomem *cir;
|
|
void __iomem *mr;
|
|
|
|
void __iomem *bar0;
|
|
void __iomem *bar1;
|
|
void __iomem *lenr;
|
|
};
|
|
|
|
struct netc_tbl_vers {
|
|
u8 maft_ver;
|
|
u8 rsst_ver;
|
|
};
|
|
|
|
struct netc_swcbd {
|
|
void *buf;
|
|
dma_addr_t dma;
|
|
size_t size;
|
|
};
|
|
|
|
struct netc_cbdr {
|
|
struct device *dev;
|
|
struct netc_cbdr_regs regs;
|
|
|
|
int bd_num;
|
|
int next_to_use;
|
|
int next_to_clean;
|
|
|
|
int dma_size;
|
|
void *addr_base;
|
|
void *addr_base_align;
|
|
dma_addr_t dma_base;
|
|
dma_addr_t dma_base_align;
|
|
struct netc_swcbd *swcbd;
|
|
|
|
/* Serialize the order of command BD ring */
|
|
struct mutex ring_lock;
|
|
};
|
|
|
|
struct ntmp_user {
|
|
int cbdr_num; /* number of control BD ring */
|
|
struct device *dev;
|
|
struct netc_cbdr *ring;
|
|
struct netc_tbl_vers tbl;
|
|
};
|
|
|
|
struct maft_entry_data {
|
|
struct maft_keye_data keye;
|
|
struct maft_cfge_data cfge;
|
|
};
|
|
|
|
#if IS_ENABLED(CONFIG_NXP_NETC_LIB)
|
|
int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,
|
|
const struct netc_cbdr_regs *regs);
|
|
void ntmp_free_cbdr(struct netc_cbdr *cbdr);
|
|
|
|
/* NTMP APIs */
|
|
int ntmp_maft_add_entry(struct ntmp_user *user, u32 entry_id,
|
|
struct maft_entry_data *maft);
|
|
int ntmp_maft_query_entry(struct ntmp_user *user, u32 entry_id,
|
|
struct maft_entry_data *maft);
|
|
int ntmp_maft_delete_entry(struct ntmp_user *user, u32 entry_id);
|
|
int ntmp_rsst_update_entry(struct ntmp_user *user, const u32 *table,
|
|
int count);
|
|
int ntmp_rsst_query_entry(struct ntmp_user *user,
|
|
u32 *table, int count);
|
|
#else
|
|
static inline int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,
|
|
const struct netc_cbdr_regs *regs)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ntmp_free_cbdr(struct netc_cbdr *cbdr)
|
|
{
|
|
}
|
|
|
|
static inline int ntmp_maft_add_entry(struct ntmp_user *user, u32 entry_id,
|
|
struct maft_entry_data *maft)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ntmp_maft_query_entry(struct ntmp_user *user, u32 entry_id,
|
|
struct maft_entry_data *maft)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ntmp_maft_delete_entry(struct ntmp_user *user, u32 entry_id)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ntmp_rsst_update_entry(struct ntmp_user *user,
|
|
const u32 *table, int count)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int ntmp_rsst_query_entry(struct ntmp_user *user,
|
|
u32 *table, int count)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
#endif
|
|
|
|
#endif
|