From: Aleksander Jan Bajkowski Date: Mon, 2 May 2022 18:31:17 +0000 (+0200) Subject: lantiq: xrx200: backport upstream network fixes X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=9423fc424c7313e470f61224eeebbaee3ff477a2;p=openwrt%2Fstaging%2Fthess.git lantiq: xrx200: backport upstream network fixes This series contains bug fixes that may occur under memory pressure. Signed-off-by: Aleksander Jan Bajkowski --- diff --git a/target/linux/lantiq/patches-5.10/0717-v6.0-net-lantiq_xrx200-confirm-skb-is-allocated-before-us.patch b/target/linux/lantiq/patches-5.10/0717-v6.0-net-lantiq_xrx200-confirm-skb-is-allocated-before-us.patch new file mode 100644 index 0000000000..9eaec58033 --- /dev/null +++ b/target/linux/lantiq/patches-5.10/0717-v6.0-net-lantiq_xrx200-confirm-skb-is-allocated-before-us.patch @@ -0,0 +1,33 @@ +From c8b043702dc0894c07721c5b019096cebc8c798f Mon Sep 17 00:00:00 2001 +From: Aleksander Jan Bajkowski +Date: Wed, 24 Aug 2022 23:54:06 +0200 +Subject: [PATCH] net: lantiq_xrx200: confirm skb is allocated before using + +xrx200_hw_receive() assumes build_skb() always works and goes straight +to skb_reserve(). However, build_skb() can fail under memory pressure. + +Add a check in case build_skb() failed to allocate and return NULL. + +Fixes: e015593573b3 ("net: lantiq_xrx200: convert to build_skb") +Reported-by: Eric Dumazet +Signed-off-by: Aleksander Jan Bajkowski +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/lantiq_xrx200.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/lantiq_xrx200.c ++++ b/drivers/net/ethernet/lantiq_xrx200.c +@@ -239,6 +239,12 @@ static int xrx200_hw_receive(struct xrx2 + } + + skb = build_skb(buf, priv->rx_skb_size); ++ if (!skb) { ++ skb_free_frag(buf); ++ net_dev->stats.rx_dropped++; ++ return -ENOMEM; ++ } ++ + skb_reserve(skb, NET_SKB_PAD); + skb_put(skb, len); + diff --git a/target/linux/lantiq/patches-5.10/0718-v6.0-net-lantiq_xrx200-fix-lock-under-memory-pressure.patch b/target/linux/lantiq/patches-5.10/0718-v6.0-net-lantiq_xrx200-fix-lock-under-memory-pressure.patch new file mode 100644 index 0000000000..929ae57ace --- /dev/null +++ b/target/linux/lantiq/patches-5.10/0718-v6.0-net-lantiq_xrx200-fix-lock-under-memory-pressure.patch @@ -0,0 +1,33 @@ +From c4b6e9341f930e4dd089231c0414758f5f1f9dbd Mon Sep 17 00:00:00 2001 +From: Aleksander Jan Bajkowski +Date: Wed, 24 Aug 2022 23:54:07 +0200 +Subject: [PATCH] net: lantiq_xrx200: fix lock under memory pressure + +When the xrx200_hw_receive() function returns -ENOMEM, the NAPI poll +function immediately returns an error. +This is incorrect for two reasons: +* the function terminates without enabling interrupts or scheduling NAPI, +* the error code (-ENOMEM) is returned instead of the number of received +packets. + +After the first memory allocation failure occurs, packet reception is +locked due to disabled interrupts from DMA.. + +Fixes: fe1a56420cf2 ("net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver") +Signed-off-by: Aleksander Jan Bajkowski +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/lantiq_xrx200.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/lantiq_xrx200.c ++++ b/drivers/net/ethernet/lantiq_xrx200.c +@@ -294,7 +294,7 @@ static int xrx200_poll_rx(struct napi_st + if (ret == XRX200_DMA_PACKET_IN_PROGRESS) + continue; + if (ret != XRX200_DMA_PACKET_COMPLETE) +- return ret; ++ break; + rx++; + } else { + break; diff --git a/target/linux/lantiq/patches-5.10/0719-v6.0-net-lantiq_xrx200-restore-buffer-if-memory-allocatio.patch b/target/linux/lantiq/patches-5.10/0719-v6.0-net-lantiq_xrx200-restore-buffer-if-memory-allocatio.patch new file mode 100644 index 0000000000..182da58ed9 --- /dev/null +++ b/target/linux/lantiq/patches-5.10/0719-v6.0-net-lantiq_xrx200-restore-buffer-if-memory-allocatio.patch @@ -0,0 +1,27 @@ +From c9c3b1775f80fa21f5bff874027d2ccb10f5d90c Mon Sep 17 00:00:00 2001 +From: Aleksander Jan Bajkowski +Date: Wed, 24 Aug 2022 23:54:08 +0200 +Subject: [PATCH] net: lantiq_xrx200: restore buffer if memory allocation + failed + +In a situation where memory allocation fails, an invalid buffer address +is stored. When this descriptor is used again, the system panics in the +build_skb() function when accessing memory. + +Fixes: 7ea6cd16f159 ("lantiq: net: fix duplicated skb in rx descriptor ring") +Signed-off-by: Aleksander Jan Bajkowski +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/lantiq_xrx200.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/lantiq_xrx200.c ++++ b/drivers/net/ethernet/lantiq_xrx200.c +@@ -193,6 +193,7 @@ static int xrx200_alloc_buf(struct xrx20 + + ch->rx_buff[ch->dma.desc] = alloc(priv->rx_skb_size); + if (!ch->rx_buff[ch->dma.desc]) { ++ ch->rx_buff[ch->dma.desc] = buf; + ret = -ENOMEM; + goto skip; + }