Skip to content

Commit ba7c793

Browse files
Jiawen Wugregkh
authored andcommitted
net: libwx: fix the using of Rx buffer DMA
commit 5fd77cc upstream. The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code. Fixes: 3c47e8a ("net: libwx: Support to receive packets in NAPI") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250714024755.17512-3-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 08d18bd commit ba7c793

File tree

2 files changed

+2
-3
lines changed

2 files changed

+2
-3
lines changed

drivers/net/ethernet/wangxun/libwx/wx_lib.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,7 @@ static bool wx_alloc_mapped_page(struct wx_ring *rx_ring,
305305
return false;
306306
dma = page_pool_get_dma_addr(page);
307307

308-
bi->page_dma = dma;
308+
bi->dma = dma;
309309
bi->page = page;
310310
bi->page_offset = 0;
311311

@@ -342,7 +342,7 @@ void wx_alloc_rx_buffers(struct wx_ring *rx_ring, u16 cleaned_count)
342342
DMA_FROM_DEVICE);
343343

344344
rx_desc->read.pkt_addr =
345-
cpu_to_le64(bi->page_dma + bi->page_offset);
345+
cpu_to_le64(bi->dma + bi->page_offset);
346346

347347
rx_desc++;
348348
bi++;

drivers/net/ethernet/wangxun/libwx/wx_type.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -874,7 +874,6 @@ struct wx_tx_buffer {
874874
struct wx_rx_buffer {
875875
struct sk_buff *skb;
876876
dma_addr_t dma;
877-
dma_addr_t page_dma;
878877
struct page *page;
879878
unsigned int page_offset;
880879
};

0 commit comments

Comments
 (0)