Re: [PATCH net-next v3 6/8] net: xilinx: tsn: add the endpoint RX data path

["Neeli, Srinivas" <srneeli@amd.com>]

Hi,

On 10/17/2026 3:04 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] net: out-of-bounds read of DMA metadata due to missing meta_len check
> --
>
> commit 0ae3124fbc7145cd6d9f2c1314d8d1defc3b13e2
> Author: Srinivas Neeli <srinivas.neeli@amd.com>
>
> net: xilinx: tsn: add the endpoint RX data path
>
> This commit adds the RX data path for the endpoint to start receiving frames.
> It posts RX buffers to the channels and handles inbound frames in a completion
> callback. It also serialises the RX refill process against the interface
> teardown.
>
>> diff --git a/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c b/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c
>> index ab3d6d8cb9440..0a13e04d40575 100644
>> --- a/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c
>> +++ b/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c
> [ ... ]
>> @@ -112,6 +135,181 @@ ep_get_desc(struct xlnx_tsn_ep_dma_chan *xchan, int idx)
>>   	return xchan->skb_ring[idx];
>>   }
>>   
> [ ... ]
>> +static void ep_dma_rx_cb(void *data, const struct dmaengine_result *result)
>> +{
> [ ... ]
>> +	metadata = dmaengine_desc_get_metadata_ptr(skbuf_dma->desc,
>> +						   &meta_len,
>> +						   &meta_max_len);
>> +	if (IS_ERR_OR_NULL(metadata)) {
>> +		if (net_ratelimit())
>> +			dev_warn(ep->dev, "Failed to get RX metadata pointer\n");
>> +
>> +		dev_kfree_skb_any(skb);
>> +		DEV_STATS_INC(ndev, rx_dropped);
>> +		DEV_STATS_INC(ndev, rx_errors);
>> +		goto submit_new;
>> +	}
>> +
>> +	/* MCDMA metadata: [0] = status, [1] = sideband (TID/TDEST/TUSER), [2..] = app */
>> +	tuser = metadata[1] & TSN_TUSER_MASK;
>                   ^^^^^^^^^^^
>
> [Severity: Medium]
> Could this result in an out-of-bounds read if the metadata array is too small?
>
> The driver gets the metadata pointer and its length via meta_len, but it only
> validates the pointer using IS_ERR_OR_NULL(). There isn't a check to see if
> meta_len is large enough before accessing metadata[1].
>
> If the DMA hardware or backend driver provides fewer than 8 bytes of metadata,
> reading from metadata[1] might result in an out-of-bounds access. Should
> there be a check that meta_len is at least 2 * sizeof(u32) before accessing
> the array?
   The length is fixed by the provider rather than by the frame. For MCDMA
   xilinx_dma_get_metadata_ptr() returns

     *max_len = *payload_len = sizeof(seg->hw.s2mm_status) +
sizeof(seg->hw.s2mm_sideband_status) +
                               sizeof(seg->hw.app);

   which is 28 bytes, and the pointer starts at the status word, so index 1
   is the sideband word and is always in range. A shorter payload is not
   reachable, and the earlier IS_ERR_OR_NULL() already covers the case 
where
   the provider attaches no metadata_ops at all.

Thanks
Srinivas Neeli