diff options
| author | Serge Semin <fancer.lancer@gmail.com> | 2025-08-01 18:26:17 +0300 |
|---|---|---|
| committer | Serge Semin <fancer.lancer@gmail.com> | 2026-08-13 20:36:23 +0300 |
| commit | a84655e43fb891b723ee9c8beacbc9af4dd3eed1 (patch) | |
| tree | e6f7136747d33d67352534875abb927724211ea0 | |
| parent | 50fc57124e412b937af7fc3d7bd43ddc6ba0a649 (diff) | |
| download | linux-a84655e43fb891b723ee9c8beacbc9af4dd3eed1.tar.gz linux-a84655e43fb891b723ee9c8beacbc9af4dd3eed1.zip | |
net: stmmac: dwxgmac2: Fix secondary buffer left enabled
In case of DW XGMAC/XLGMAC IP-cores the secondary Rx DMA-buffer can be
specified in the framework of the Split Packet Header feature
implementation. But the feature can be disabled in runtime if an XDP BPF
program is installed meanwhile the secondary buffer address won't be
properly cleaned up. As a result the secondary buffer will be left enabled
in the Rx DMA-descriptors even though it isn't utilized in the driver.
In the worst-case scenario a part of the Rx-frames will be received to the
already long freed memory page thus corrupting it' content. It's possible
in case of a sudden Jumbo frame reception.
[1] DesignWare Cores XGMAC - 10G Ethernet MAC Databook, Revision 3.20a,
September 2022, p.251.
Fixes: 67afd6d1cfdf ("net: stmmac: Add Split Header support and enable it in XGMAC cores")
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
| -rw-r--r-- | drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c | 9 | ||||
| -rw-r--r-- | drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 |
2 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c index 7301df6a6d34..c61b14344300 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c @@ -448,8 +448,13 @@ static void dwxgmac2_get_rx_header_len(struct dma_desc *p, unsigned int *len) static void dwxgmac2_set_sec_addr(struct dma_desc *p, dma_addr_t addr, bool is_valid) { - p->des2 = cpu_to_le32(lower_32_bits(addr)); - p->des3 = cpu_to_le32(upper_32_bits(addr)); + if (is_valid) { + p->des2 = cpu_to_le32(lower_32_bits(addr)); + p->des3 = cpu_to_le32(upper_32_bits(addr)); + } else { + p->des2 = 0; + p->des3 = 0; + } } static void dwxgmac2_set_sarc(struct dma_desc *p, u32 sarc_type) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 04ffac733947..4caa0b5210ce 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -1872,6 +1872,7 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, true); } else { buf->sec_page = NULL; + buf->sec_addr = 0; stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, false); } |