bcm4908: backport bcm4908_enet fix for NULL dereference
authorRafał Miłecki <rafal@milecki.pl>
Thu, 27 Oct 2022 19:05:20 +0000 (21:05 +0200)
committerRafał Miłecki <rafal@milecki.pl>
Thu, 3 Nov 2022 08:26:20 +0000 (09:26 +0100)
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 31e4e566545e53594bafe846c170a5d2fa6821e3)

target/linux/bcm4908/patches-5.4/077-v5.17-net-broadcom-bcm4908enet-remove-redundant-variable-b.patch [new file with mode: 0644]
target/linux/bcm4908/patches-5.4/078-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch [new file with mode: 0644]
target/linux/bcm4908/patches-5.4/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch [new file with mode: 0644]
target/linux/bcm4908/patches-5.4/078-v6.1-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch [deleted file]
target/linux/bcm4908/patches-5.4/079-v6.2-0001-net-broadcom-bcm4908_enet-use-build_skb.patch

diff --git a/target/linux/bcm4908/patches-5.4/077-v5.17-net-broadcom-bcm4908enet-remove-redundant-variable-b.patch b/target/linux/bcm4908/patches-5.4/077-v5.17-net-broadcom-bcm4908enet-remove-redundant-variable-b.patch
new file mode 100644 (file)
index 0000000..03e546c
--- /dev/null
@@ -0,0 +1,34 @@
+From 62a3106697f3c6f9af64a2cd0f9ff58552010dc8 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.i.king@gmail.com>
+Date: Wed, 22 Dec 2021 00:39:37 +0000
+Subject: [PATCH] net: broadcom: bcm4908enet: remove redundant variable bytes
+
+The variable bytes is being used to summate slot lengths,
+however the value is never used afterwards. The summation
+is redundant so remove variable bytes.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20211222003937.727325-1-colin.i.king@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -634,7 +634,6 @@ static int bcm4908_enet_poll_tx(struct n
+       struct bcm4908_enet_dma_ring_bd *buf_desc;
+       struct bcm4908_enet_dma_ring_slot *slot;
+       struct device *dev = enet->dev;
+-      unsigned int bytes = 0;
+       int handled = 0;
+       while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
+@@ -645,7 +644,6 @@ static int bcm4908_enet_poll_tx(struct n
+               dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
+               dev_kfree_skb(slot->skb);
+-              bytes += slot->len;
+               if (++tx_ring->read_idx == tx_ring->length)
+                       tx_ring->read_idx = 0;
diff --git a/target/linux/bcm4908/patches-5.4/078-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch b/target/linux/bcm4908/patches-5.4/078-v6.1-0001-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
new file mode 100644 (file)
index 0000000..f97a909
--- /dev/null
@@ -0,0 +1,61 @@
+From e93a766da57fff3273bcb618edf5dfca1fb86b89 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 15 Sep 2022 15:30:13 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: handle -EPROBE_DEFER when
+ getting MAC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reading MAC from OF may return -EPROBE_DEFER if underlaying NVMEM device
+isn't ready yet. In such case pass that error code up and "wait" to be
+probed later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20220915133013.2243-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -714,10 +714,14 @@ static int bcm4908_enet_probe(struct pla
+       SET_NETDEV_DEV(netdev, &pdev->dev);
+       mac = of_get_mac_address(dev->of_node);
+-      if (!IS_ERR(mac))
++      if (!IS_ERR(mac)) {
+               ether_addr_copy(netdev->dev_addr, mac);
+-      else
++      } else if (PTR_ERR(mac) == -EPROBE_DEFER) {
++              err = -EPROBE_DEFER;
++              goto err_dma_free;
++      } else {
+               eth_hw_addr_random(netdev);
++      }
+       netdev->netdev_ops = &bcm4908_enet_netdev_ops;
+       netdev->min_mtu = ETH_ZLEN;
+       netdev->mtu = ETH_DATA_LEN;
+@@ -726,14 +730,17 @@ static int bcm4908_enet_probe(struct pla
+       netif_napi_add(netdev, &enet->rx_ring.napi, bcm4908_enet_poll_rx, NAPI_POLL_WEIGHT);
+       err = register_netdev(netdev);
+-      if (err) {
+-              bcm4908_enet_dma_free(enet);
+-              return err;
+-      }
++      if (err)
++              goto err_dma_free;
+       platform_set_drvdata(pdev, enet);
+       return 0;
++
++err_dma_free:
++      bcm4908_enet_dma_free(enet);
++
++      return err;
+ }
+ static int bcm4908_enet_remove(struct platform_device *pdev)
diff --git a/target/linux/bcm4908/patches-5.4/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch b/target/linux/bcm4908/patches-5.4/078-v6.1-0002-net-broadcom-bcm4908_enet-update-TX-stats-after-actu.patch
new file mode 100644 (file)
index 0000000..29cf374
--- /dev/null
@@ -0,0 +1,65 @@
+From ef3556ee16c68735ec69bd08df41d1cd83b14ad3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 27 Oct 2022 13:24:30 +0200
+Subject: [PATCH] net: broadcom: bcm4908_enet: update TX stats after actual
+ transmission
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Queueing packets doesn't guarantee their transmission. Update TX stats
+after hardware confirms consuming submitted data.
+
+This also fixes a possible race and NULL dereference.
+bcm4908_enet_start_xmit() could try to access skb after freeing it in
+the bcm4908_enet_poll_tx().
+
+Reported-by: Florian Fainelli <f.fainelli@gmail.com>
+Fixes: 4feffeadbcb2e ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20221027112430.8696-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -560,8 +560,6 @@ static int bcm4908_enet_start_xmit(struc
+       if (++ring->write_idx == ring->length - 1)
+               ring->write_idx = 0;
+-      enet->netdev->stats.tx_bytes += skb->len;
+-      enet->netdev->stats.tx_packets++;
+       return NETDEV_TX_OK;
+ }
+@@ -634,6 +632,7 @@ static int bcm4908_enet_poll_tx(struct n
+       struct bcm4908_enet_dma_ring_bd *buf_desc;
+       struct bcm4908_enet_dma_ring_slot *slot;
+       struct device *dev = enet->dev;
++      unsigned int bytes = 0;
+       int handled = 0;
+       while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
+@@ -644,12 +643,17 @@ static int bcm4908_enet_poll_tx(struct n
+               dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
+               dev_kfree_skb(slot->skb);
+-              if (++tx_ring->read_idx == tx_ring->length)
+-                      tx_ring->read_idx = 0;
+               handled++;
++              bytes += slot->len;
++
++              if (++tx_ring->read_idx == tx_ring->length)
++                      tx_ring->read_idx = 0;
+       }
++      enet->netdev->stats.tx_packets += handled;
++      enet->netdev->stats.tx_bytes += bytes;
++
+       if (handled < weight) {
+               napi_complete_done(napi, handled);
+               bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);
diff --git a/target/linux/bcm4908/patches-5.4/078-v6.1-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch b/target/linux/bcm4908/patches-5.4/078-v6.1-net-broadcom-bcm4908_enet-handle-EPROBE_DEFER-when-g.patch
deleted file mode 100644 (file)
index de13dcf..0000000
+++ /dev/null
@@ -1,61 +0,0 @@
-From e93a766da57fff3273bcb618edf5dfca1fb86b89 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Thu, 15 Sep 2022 15:30:13 +0200
-Subject: [PATCH] net: broadcom: bcm4908_enet: handle -EPROBE_DEFER when
- getting MAC
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reading MAC from OF may return -EPROBE_DEFER if underlaying NVMEM device
-isn't ready yet. In such case pass that error code up and "wait" to be
-probed later.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Link: https://lore.kernel.org/r/20220915133013.2243-1-zajec5@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
- drivers/net/ethernet/broadcom/bcm4908_enet.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
---- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
-+++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
-@@ -716,10 +716,14 @@ static int bcm4908_enet_probe(struct pla
-       SET_NETDEV_DEV(netdev, &pdev->dev);
-       mac = of_get_mac_address(dev->of_node);
--      if (!IS_ERR(mac))
-+      if (!IS_ERR(mac)) {
-               ether_addr_copy(netdev->dev_addr, mac);
--      else
-+      } else if (PTR_ERR(mac) == -EPROBE_DEFER) {
-+              err = -EPROBE_DEFER;
-+              goto err_dma_free;
-+      } else {
-               eth_hw_addr_random(netdev);
-+      }
-       netdev->netdev_ops = &bcm4908_enet_netdev_ops;
-       netdev->min_mtu = ETH_ZLEN;
-       netdev->mtu = ETH_DATA_LEN;
-@@ -728,14 +732,17 @@ static int bcm4908_enet_probe(struct pla
-       netif_napi_add(netdev, &enet->rx_ring.napi, bcm4908_enet_poll_rx, NAPI_POLL_WEIGHT);
-       err = register_netdev(netdev);
--      if (err) {
--              bcm4908_enet_dma_free(enet);
--              return err;
--      }
-+      if (err)
-+              goto err_dma_free;
-       platform_set_drvdata(pdev, enet);
-       return 0;
-+
-+err_dma_free:
-+      bcm4908_enet_dma_free(enet);
-+
-+      return err;
- }
- static int bcm4908_enet_remove(struct platform_device *pdev)
index 1a3dc62d444dffd74258edb36b49b4a12aac0fde..834973f5c7812c88c093e8a8037c2ee7d680e315 100644 (file)
@@ -112,7 +112,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
        }
  }
  
-@@ -576,6 +586,7 @@ static int bcm4908_enet_poll_rx(struct n
+@@ -574,6 +584,7 @@ static int bcm4908_enet_poll_rx(struct n
        while (handled < weight) {
                struct bcm4908_enet_dma_ring_bd *buf_desc;
                struct bcm4908_enet_dma_ring_slot slot;
@@ -120,7 +120,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
                u32 ctl;
                int len;
                int err;
-@@ -599,16 +610,24 @@ static int bcm4908_enet_poll_rx(struct n
+@@ -597,16 +608,24 @@ static int bcm4908_enet_poll_rx(struct n
  
                if (len < ETH_ZLEN ||
                    (ctl & (DMA_CTL_STATUS_SOP | DMA_CTL_STATUS_EOP)) != (DMA_CTL_STATUS_SOP | DMA_CTL_STATUS_EOP)) {