Commit c113d5e3 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net-spacemit-a-few-error-handling-fixes' 

Vivian Wang says:

====================
net: spacemit: A few error handling fixes

Recently a user reported a supposed UAF/double-free in this driver.
It turned out to be a false positive (ugh) from a bug with riscv's
kfence_protect_page() [1], but it did also prompt me to review the
driver code yet again. These are some fixes for error handling problems
that I've found.

[1]: https://lore.kernel.org/r/20260303-handle-kfence-protect-spurious-fault-v2-0-f80d8354d79d@iscas.ac.cn/
====================

Link: https://patch.msgid.link/20260305-k1-ethernet-more-fixes-v2-0-e4e434d65055@iscas.ac.cn


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 4245a790 86292155

drivers/net/ethernet/spacemit/k1_emac.c

+13 −6
Original line number Diff line number Diff line
@@ -565,7 +565,9 @@ static void emac_alloc_rx_desc_buffers(struct emac_priv *priv) 
						  DMA_FROM_DEVICE);

		if (dma_mapping_error(&priv->pdev->dev, rx_buf->dma_addr)) {

			dev_err_ratelimited(&ndev->dev, "Mapping skb failed\n");

			goto err_free_skb;

			dev_kfree_skb_any(skb);

			rx_buf->skb = NULL;

			break;

		}



		rx_desc_addr = &((struct emac_desc *)rx_ring->desc_addr)[i];
@@ -590,10 +592,6 @@ static void emac_alloc_rx_desc_buffers(struct emac_priv *priv) 


	rx_ring->head = i;

	return;



err_free_skb:

	dev_kfree_skb_any(skb);

	rx_buf->skb = NULL;

}



/* Returns number of packets received */
@@ -735,7 +733,7 @@ static void emac_tx_mem_map(struct emac_priv *priv, struct sk_buff *skb) 
	struct emac_desc tx_desc, *tx_desc_addr;

	struct device *dev = &priv->pdev->dev;

	struct emac_tx_desc_buffer *tx_buf;

	u32 head, old_head, frag_num, f;

	u32 head, old_head, frag_num, f, i;

	bool buf_idx;



	frag_num = skb_shinfo(skb)->nr_frags;
@@ -803,6 +801,15 @@ static void emac_tx_mem_map(struct emac_priv *priv, struct sk_buff *skb) 


err_free_skb:

	dev_dstats_tx_dropped(priv->ndev);



	i = old_head;

	while (i != head) {

		emac_free_tx_buf(priv, i);



		if (++i == tx_ring->total_cnt)

			i = 0;

	}



	dev_kfree_skb_any(skb);

}