public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

net: axienet: Fix casting of pointers to u32

Browse source 
This driver was casting skb pointers to u32 and storing them as such in
the DMA buffer descriptor, which is obviously broken on 64-bit. The area
of the buffer descriptor being used is not accessed by the hardware and
has sufficient room for a 32 or 64-bit pointer, so just store the skb
pointer as such.

Signed-off-by: Robert Hancock <hancock@sedsystems.ca>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Robert Hancock 2019-06-06 16:28:05 -06:00 • committed by David S. Miller
parent 40ae25505f
commit 23e6b2dc93
2 changed files with 17 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/net/ethernet/xilinx/xilinx_axienet.h
View file

@ -356,9 +356,6 @@
* @app2: MM2S/S2MM User Application Field 2. * @app2: MM2S/S2MM User Application Field 2.
* @app3: MM2S/S2MM User Application Field 3. * @app3: MM2S/S2MM User Application Field 3.
* @app4: MM2S/S2MM User Application Field 4. * @app4: MM2S/S2MM User Application Field 4.
* @sw_id_offset: MM2S/S2MM Sw ID
* @reserved5: Reserved and not used
* @reserved6: Reserved and not used
*/ */
struct axidma_bd { struct axidma_bd {
u32 next; /* Physical address of next buffer descriptor */ u32 next; /* Physical address of next buffer descriptor */
@ -373,11 +370,9 @@ struct axidma_bd {
u32 app1; /* TX start << 16 | insert */ u32 app1; /* TX start << 16 | insert */
u32 app2; /* TX csum seed */ u32 app2; /* TX csum seed */
u32 app3; u32 app3;
u32 app4; u32 app4; /* Last field used by HW */
u32 sw_id_offset; struct sk_buff *skb;
u32 reserved5; } __aligned(XAXIDMA_BD_MINIMUM_ALIGNMENT);
u32 reserved6;
};
/** /**
* struct axienet_local - axienet private per device data * struct axienet_local - axienet private per device data

26
drivers/net/ethernet/xilinx/xilinx_axienet_main.c
View file

@ -159,8 +159,7 @@ static void axienet_dma_bd_release(struct net_device *ndev)
for (i = 0; i < RX_BD_NUM; i++) { for (i = 0; i < RX_BD_NUM; i++) {
dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys, dma_unmap_single(ndev->dev.parent, lp->rx_bd_v[i].phys,
lp->max_frm_size, DMA_FROM_DEVICE); lp->max_frm_size, DMA_FROM_DEVICE);
dev_kfree_skb((struct sk_buff *) dev_kfree_skb(lp->rx_bd_v[i].skb);
(lp->rx_bd_v[i].sw_id_offset));
} }
if (lp->rx_bd_v) { if (lp->rx_bd_v) {
@ -227,7 +226,7 @@ static int axienet_dma_bd_init(struct net_device *ndev)
if (!skb) if (!skb)
goto out; goto out;
lp->rx_bd_v[i].sw_id_offset = (u32) skb; lp->rx_bd_v[i].skb = skb;
lp->rx_bd_v[i].phys = dma_map_single(ndev->dev.parent, lp->rx_bd_v[i].phys = dma_map_single(ndev->dev.parent,
skb->data, skb->data,
lp->max_frm_size, lp->max_frm_size,
@ -595,14 +594,15 @@ static void axienet_start_xmit_done(struct net_device *ndev)
dma_unmap_single(ndev->dev.parent, cur_p->phys, dma_unmap_single(ndev->dev.parent, cur_p->phys,
(cur_p->cntrl & XAXIDMA_BD_CTRL_LENGTH_MASK), (cur_p->cntrl & XAXIDMA_BD_CTRL_LENGTH_MASK),
DMA_TO_DEVICE); DMA_TO_DEVICE);
if (cur_p->app4) if (cur_p->skb)
dev_consume_skb_irq((struct sk_buff *)cur_p->app4); dev_consume_skb_irq(cur_p->skb);
/*cur_p->phys = 0;*/ /*cur_p->phys = 0;*/
cur_p->app0 = 0; cur_p->app0 = 0;
cur_p->app1 = 0; cur_p->app1 = 0;
cur_p->app2 = 0; cur_p->app2 = 0;
cur_p->app4 = 0; cur_p->app4 = 0;
cur_p->status = 0; cur_p->status = 0;
cur_p->skb = NULL;
size += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK; size += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
packets++; packets++;
@ -707,7 +707,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
} }
cur_p->cntrl |= XAXIDMA_BD_CTRL_TXEOF_MASK; cur_p->cntrl |= XAXIDMA_BD_CTRL_TXEOF_MASK;
cur_p->app4 = (unsigned long)skb; cur_p->skb = skb;
tail_p = lp->tx_bd_p + sizeof(*lp->tx_bd_v) * lp->tx_bd_tail; tail_p = lp->tx_bd_p + sizeof(*lp->tx_bd_v) * lp->tx_bd_tail;
/* Start the transfer */ /* Start the transfer */
@ -742,13 +742,15 @@ static void axienet_recv(struct net_device *ndev)
while ((cur_p->status & XAXIDMA_BD_STS_COMPLETE_MASK)) { while ((cur_p->status & XAXIDMA_BD_STS_COMPLETE_MASK)) {
tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci; tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci;
skb = (struct sk_buff *) (cur_p->sw_id_offset);
length = cur_p->app4 & 0x0000FFFF;
dma_unmap_single(ndev->dev.parent, cur_p->phys, dma_unmap_single(ndev->dev.parent, cur_p->phys,
lp->max_frm_size, lp->max_frm_size,
DMA_FROM_DEVICE); DMA_FROM_DEVICE);
skb = cur_p->skb;
cur_p->skb = NULL;
length = cur_p->app4 & 0x0000FFFF;
skb_put(skb, length); skb_put(skb, length);
skb->protocol = eth_type_trans(skb, ndev); skb->protocol = eth_type_trans(skb, ndev);
/*skb_checksum_none_assert(skb);*/ /*skb_checksum_none_assert(skb);*/
@ -783,7 +785,7 @@ static void axienet_recv(struct net_device *ndev)
DMA_FROM_DEVICE); DMA_FROM_DEVICE);
cur_p->cntrl = lp->max_frm_size; cur_p->cntrl = lp->max_frm_size;
cur_p->status = 0; cur_p->status = 0;
cur_p->sw_id_offset = (u32) new_skb; cur_p->skb = new_skb;
++lp->rx_bd_ci; ++lp->rx_bd_ci;
lp->rx_bd_ci %= RX_BD_NUM; lp->rx_bd_ci %= RX_BD_NUM;
@ -1343,8 +1345,8 @@ static void axienet_dma_err_handler(unsigned long data)
(cur_p->cntrl & (cur_p->cntrl &
XAXIDMA_BD_CTRL_LENGTH_MASK), XAXIDMA_BD_CTRL_LENGTH_MASK),
DMA_TO_DEVICE); DMA_TO_DEVICE);
if (cur_p->app4) if (cur_p->skb)
dev_kfree_skb_irq((struct sk_buff *) cur_p->app4); dev_kfree_skb_irq(cur_p->skb);
cur_p->phys = 0; cur_p->phys = 0;
cur_p->cntrl = 0; cur_p->cntrl = 0;
cur_p->status = 0; cur_p->status = 0;
@ -1353,7 +1355,7 @@ static void axienet_dma_err_handler(unsigned long data)
cur_p->app2 = 0; cur_p->app2 = 0;
cur_p->app3 = 0; cur_p->app3 = 0;
cur_p->app4 = 0; cur_p->app4 = 0;
cur_p->sw_id_offset = 0; cur_p->skb = NULL;
} }
for (i = 0; i < RX_BD_NUM; i++) { for (i = 0; i < RX_BD_NUM; i++) {