openwrt/target/linux/airoha/patches-6.6/008-v6.11-net-airoha-Fix-NULL-pointer-dereference-in-airoha_qd.patch
Christian Marangi 9131cb44ff
airoha: Introduce EN7581 SoC support
Introduce EN7581 SoC support with currently rfb board supported.

This is a new 64bit SoC from Airoha that is currently almost fully
supported upstream with only the DTS missing. Setting source-only
waiting for the full upstream support to be completed.

Link: https://github.com/openwrt/openwrt/pull/16730
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2024-10-20 23:24:08 +02:00

40 lines
1.6 KiB
Diff

From 4e076ff6ad5302c015617da30d877b4cdcbdf613 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Wed, 17 Jul 2024 10:47:19 +0200
Subject: [PATCH] net: airoha: Fix NULL pointer dereference in
airoha_qdma_cleanup_rx_queue()
Move page_pool_get_dma_dir() inside the while loop of
airoha_qdma_cleanup_rx_queue routine in order to avoid possible NULL
pointer dereference if airoha_qdma_init_rx_queue() fails before
properly allocating the page_pool pointer.
Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/7330a41bba720c33abc039955f6172457a3a34f0.1721205981.git.lorenzo@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
drivers/net/ethernet/mediatek/airoha_eth.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/mediatek/airoha_eth.c
+++ b/drivers/net/ethernet/mediatek/airoha_eth.c
@@ -1586,7 +1586,6 @@ static int airoha_qdma_init_rx_queue(str
static void airoha_qdma_cleanup_rx_queue(struct airoha_queue *q)
{
- enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
struct airoha_eth *eth = q->eth;
while (q->queued) {
@@ -1594,7 +1593,7 @@ static void airoha_qdma_cleanup_rx_queue
struct page *page = virt_to_head_page(e->buf);
dma_sync_single_for_cpu(eth->dev, e->dma_addr, e->dma_len,
- dir);
+ page_pool_get_dma_dir(q->page_pool));
page_pool_put_full_page(q->page_pool, page, false);
q->tail = (q->tail + 1) % q->ndesc;
q->queued--;