From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932869AbbLROSu (ORCPT ); Fri, 18 Dec 2015 09:18:50 -0500 Received: from mout.kundenserver.de ([212.227.126.134]:53407 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932797AbbLROSp (ORCPT ); Fri, 18 Dec 2015 09:18:45 -0500 From: Arnd Bergmann To: David Miller Cc: netdev@vger.kernel.org, w-kwok2@ti.com, m-karicheri2@ti.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH] netcp: fix regression in receive processing Date: Fri, 18 Dec 2015 15:18:08 +0100 Message-ID: <1651314.QiL8XMyoqS@wuerfel> User-Agent: KMail/4.11.5 (Linux/3.16.0-10-generic; KDE/4.11.5; x86_64; ; ) MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Provags-ID: V03:K0:NEw11NovsqZpRS1Azqo/lhgIvLXLXm6IJGCV7MXCFqFlyqXrvnS sHGihXjASHLMVm5dSraohUUq9/fHDmYRCPg4/KEIq4J+9UdLxMImqH8mG5G6tIoZtchLvoC Y9+uUX/ysf41QaVQBwSiSA1AAc46Fss1raGGI5osP61Wxn3otvomxtavVC6s5Gb6VdH4gP3 OeW6zjsye5iKk2zUreePg== X-UI-Out-Filterresults: notjunk:1;V01:K0:Onc2IsI1WTo=:DvH+bfZEM+mmqtJv0ltAmR SsXQkc9F5t5Mgcx+JYn+QXg+helhGkudtQBBCGF8sPGFQgubZMd9mpe3NTKiBRvAHrc52g6x4 R6Efp8+jO+mgt/dabF5HRBS2R3z00ASTUYyFzfdaK3uMTTkU1VEjN3K8RJ7jnbQT1gJUE3zdd /tPOy0nSR9y6UZhc/HoctoauPR+l4naYwYc4gY8zeNdi0qSSg1bzhIHQGHzs8bmG3M5BilA7b MpwAEzUqIfJK00gj//kErJ4DjPmtup3ma07HSRrwGnmTUilg3qhkzdLaBOo9lGF6gQV4KS17P L1b/GHCAX0wAE0AdOD3mI+Blr55Bcd9qSINv1OD9p0+5ovvfbfUA782Sp41fxTotV2079SBf3 NcDWhlpJRoaNok/NqZH0aqzHQ44SlFM/rEjTgrzRO6emC1g2NrzR9dSNX5ay8joRyxFRkd3qK LngB3k9V01EgCodCftHSMHxeBSeW/PD+cFYrP26O6/a4OqXQj1Aw4F7Ncsco9Wgf4z8EDbW7E o2tmYOrjskpEReCn95P91F/8TMXsqLTbiGybUth4oEr8HHDko6qQaeS29cv7BwuGbl3c5fc7L 5zlVoUZR7NT1cFwSPR+yTiKqTxwAN171p8TBxLd0OAc68UZFXiyPnvG+B1c1BB/KwgBZMk4Qs HjvOC1BzZ5IOc/VD+etnSFY0X0uAxIm1wwTcy19NM6+30ctr/zdPBA3BP3Sfy0Fq2ss+z4Aqa TOs5FCh5b7Z7doe+ Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org A cleanup patch I did was unfortunately wrong and introduced multiple serious bugs in the netcp rx processing, as indicated by these correct gcc warnings: drivers/net/ethernet/ti/netcp_core.c:776:14: warning: 'buf_ptr' may be used uninitialized in this function [-Wuninitialized] drivers/net/ethernet/ti/netcp_core.c:687:14: warning: 'ptr' may be used uninitialized in this function [-Wuninitialized] I have checked the patch once more and found that a call to get_pkt_info() accidentally got removed in netcp_free_rx_desc_chain, and netcp_process_one_rx_packet no longer retrieved the correct buffer length. This patch should fix all the known problems, but I did not test on real hardware. Signed-off-by: Arnd Bergmann Fixes: 899077791403 ("netcp: try to reduce type confusion in descriptors") diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c index 92d08eb262c2..c61d66d38634 100644 --- a/drivers/net/ethernet/ti/netcp_core.c +++ b/drivers/net/ethernet/ti/netcp_core.c @@ -582,6 +582,7 @@ static void netcp_free_rx_desc_chain(struct netcp_intf *netcp, unsigned int buf_len, dma_sz = sizeof(*ndesc); void *buf_ptr; u32 pad[2]; + u32 tmp; get_words(&dma_desc, 1, &desc->next_desc); @@ -591,6 +592,7 @@ static void netcp_free_rx_desc_chain(struct netcp_intf *netcp, dev_err(netcp->ndev_dev, "failed to unmap Rx desc\n"); break; } + get_pkt_info(&dma_buf, &tmp, &dma_desc, ndesc); get_pad_ptr(&buf_ptr, ndesc); dma_unmap_page(netcp->dev, dma_buf, PAGE_SIZE, DMA_FROM_DEVICE); __free_page(buf_ptr); @@ -637,6 +639,7 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp) dma_addr_t dma_desc, dma_buff; struct netcp_packet p_info; struct sk_buff *skb; + u32 pad[2]; void *org_buf_ptr; dma_desc = knav_queue_pop(netcp->rx_queue, &dma_sz); @@ -650,7 +653,8 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp) } get_pkt_info(&dma_buff, &buf_len, &dma_desc, desc); - get_pad_ptr(&org_buf_ptr, desc); + get_pad_info(&pad[0], &pad[1], &org_buf_len, desc); + org_buf_ptr = (void *)(uintptr_t)(pad[0] + ((u64)pad[1] << 32)); if (unlikely(!org_buf_ptr)) { dev_err(netcp->ndev_dev, "NULL bufptr in desc\n"); @@ -684,7 +688,7 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp) } get_pkt_info(&dma_buff, &buf_len, &dma_desc, ndesc); - get_pad_ptr(ptr, ndesc); + get_pad_ptr(&ptr, ndesc); page = ptr; if (likely(dma_buff && buf_len && page)) { @@ -773,7 +777,7 @@ static void netcp_free_rx_buf(struct netcp_intf *netcp, int fdq) } get_org_pkt_info(&dma, &buf_len, desc); - get_pad_ptr(buf_ptr, desc); + get_pad_ptr(&buf_ptr, desc); if (unlikely(!dma)) { dev_err(netcp->ndev_dev, "NULL orig_buff in desc\n");