github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 20:54:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: sgi: ioc3-eth: fix split TX DMA mapping lengths

Browse Source 
When a linear skb crosses a 16 KiB boundary, ioc3_start_xmit()
splits it into two buffers of lengths s1 and s2.  The descriptor
advertises those lengths through B1CNT and B2CNT.

The first buffer is mapped with s1, but the second buffer is also
mapped with s1 even though the device is told to fetch s2 bytes from
it.  When the lengths differ, the DMA mapping does not cover the same
region as the second descriptor buffer, which can result in incorrect
cache maintenance or a DMA fault on implementations that enforce the
mapped range.

There is a separate mismatch in the error path.  If mapping the second
buffer fails, only d1 needs to be unmapped.  d1 was mapped for s1 bytes,
but the driver unmaps it using the full packet length.  Streaming DMA
mappings must be unmapped with the same size used for the corresponding
map operation.

Map the second buffer with s2 and unmap the first buffer with s1 when
the second mapping fails.

Cc: <stable+noautosel@kernel.org> # untested fix for ancient HW
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://patch.msgid.link/4E1486BC4536407E+20260629080623.908426-1-raoxu@uniontech.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Xu Rao 2026-06-29 16:06:23 +08:00 committed by Jakub Kicinski
parent 18a28f3e10
commit cd066559a0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/ethernet/sgi/ioc3-eth.c
View File

@ -1062,9 +1062,9 @@ static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
d1 = dma_map_single(ip->dma_dev, skb->data, s1, DMA_TO_DEVICE);
if (dma_mapping_error(ip->dma_dev, d1))
goto drop_packet;
d2 = dma_map_single(ip->dma_dev, (void *)b2, s1, DMA_TO_DEVICE);
d2 = dma_map_single(ip->dma_dev, (void *)b2, s2, DMA_TO_DEVICE);
if (dma_mapping_error(ip->dma_dev, d2)) {
dma_unmap_single(ip->dma_dev, d1, len, DMA_TO_DEVICE);
dma_unmap_single(ip->dma_dev, d1, s1, DMA_TO_DEVICE);
goto drop_packet;
}
desc->p1 = cpu_to_be64(ioc3_map(d1, PCI64_ATTR_PREF));