Files
linux/include/linux
Wei Fang 3cade69888 net: enetc: fix NTMP DMA use-after-free issue
The AI-generated review reported a potential DMA use-after-free issue
[1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending
command is not explicitly aborted, while ntmp_free_data_mem()
unconditionally frees the DMA buffer. If the buffer has already been
reallocated elsewhere, this may lead to silent memory corruption. Because
the hardware eventually processes the pending command and perform a DMA
write of the response to the physical address of the freed buffer.

To resolve this issue, this patch does the following modifications:

1. Convert cbdr->ring_lock from a spinlock to a mutex

The lock was originally a spinlock in case NTMP operations might be
invoked from atomic context. After downstream support for all NTMP
tables, no such usage has materialized. A mutex lock is now required
because the driver now needs to reclaim used BDs and release associated
DMA memory within the lock's context, while dma_free_coherent() might
sleep.

2. Introduce software command BD (struct netc_swcbd)

The hardware write-back overwrites the addr and len fields of the BD,
so the driver cannot rely on the hardware BD to free the associated DMA
memory. The driver now maintains a software shadow BD storing the DMA
buffer pointer, DMA address, and size. And netc_xmit_ntmp_cmd() only
reclaims older BDs when the number of used BDs reaches
NETC_CBDR_CLEAN_WORK (16). The software BD enables correct DMA memory
release. With this, struct ntmp_dma_buf and ntmp_free_data_mem() are no
longer needed and are removed.

3. Require callers to hold ring_lock across netc_xmit_ntmp_cmd()

netc_xmit_ntmp_cmd() releases the ring_lock before the caller finishes
consuming the response. At this point, if a concurrent thread submits
a new command, it may trigger ntmp_clean_cbdr() and free the DMA buffer
while it is still in use. Move ring_lock ownership to the caller to
ensure the response buffer cannot be reclaimed prematurely. So the
helpers ntmp_select_and_lock_cbdr() and ntmp_unlock_cbdr() are added.

These changes eliminate the DMA use-after-free condition and ensure safe
and consistent BD reclamation and DMA buffer lifecycle management.

Fixes: 4701073c3d ("net: enetc: add initial netc-lib driver to support NTMP")
Link: https://lore.kernel.org/netdev/20260403011729.1795413-1-kuba@kernel.org/ # [1]
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20260415060833.2303846-3-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-16 19:27:51 -07:00
..
2026-02-11 13:44:47 +01:00
2025-10-22 07:54:33 +02:00
2026-01-29 20:21:41 +01:00
2025-09-05 15:06:03 +02:00
2026-04-09 21:40:22 +02:00
2026-01-20 19:44:19 -08:00
2026-04-03 16:53:50 -04:00
2026-04-07 08:22:24 -06:00
2026-04-08 18:09:56 -07:00
2025-11-21 11:21:31 +01:00
2026-04-04 08:10:37 -06:00
2026-03-16 13:16:49 +01:00
2026-03-02 17:08:05 -05:00
2026-04-10 11:25:34 -05:00
2025-09-23 11:13:22 +02:00
2026-03-31 19:15:21 +02:00
2025-12-16 14:40:51 +01:00
2025-10-22 07:55:00 +02:00
2025-11-01 12:44:49 -05:00
2025-12-13 20:04:32 +12:00
2026-03-23 13:33:51 -04:00
2026-02-19 09:12:05 +01:00
2025-12-23 11:23:10 -08:00
2026-02-27 16:40:16 +01:00
2026-03-26 15:03:30 +01:00
2025-10-29 18:28:29 -07:00
2025-09-13 17:32:44 -07:00
2026-01-12 16:52:09 +01:00
2025-11-04 12:36:02 +01:00
2026-02-06 07:29:14 -07:00
2025-10-22 07:53:15 +02:00
2025-09-23 11:13:22 +02:00
2026-01-05 16:43:31 +01:00
2026-01-11 06:09:11 -10:00
2026-04-01 10:19:41 +02:00
2026-04-03 16:53:50 -04:00
2026-04-03 16:53:50 -04:00
2026-01-20 19:24:50 -08:00
2026-01-26 19:03:47 -08:00
2025-11-23 12:30:40 +01:00
2025-12-29 11:53:38 +01:00
2026-01-26 20:02:27 -08:00
2025-09-17 15:58:29 -04:00
2026-03-08 11:06:53 +01:00
2025-09-23 13:28:20 -04:00
2025-11-05 23:58:20 +01:00
2025-11-03 17:41:17 +01:00
2025-11-11 10:01:30 +01:00
2026-02-20 17:31:55 -05:00
2026-03-27 07:35:05 -07:00
2026-03-12 16:18:49 +01:00
2026-01-30 11:34:34 +00:00
2025-09-13 16:55:07 -07:00
2026-02-10 11:39:31 +01:00
2026-02-10 11:39:30 +01:00
2026-01-11 06:09:11 -10:00
2025-08-24 11:41:11 -06:00
2025-10-30 18:35:26 +01:00
2025-10-24 21:39:27 +02:00
2025-10-31 10:16:23 +01:00
2026-03-27 17:14:31 -07:00
2026-02-27 16:40:16 +01:00
2025-11-18 17:52:54 +01:00
2026-01-11 06:09:11 -10:00
2026-03-08 11:06:53 +01:00
2025-11-28 09:21:18 -07:00
2026-03-31 07:04:00 -06:00
2026-03-25 20:11:29 +01:00
2026-01-31 14:22:57 -08:00
2026-03-23 12:41:58 +01:00
2026-01-14 12:04:34 +01:00
2026-04-13 08:39:51 -07:00
2026-01-11 06:09:11 -10:00
2025-11-03 17:41:18 +01:00
2026-01-20 19:24:47 -08:00
2026-01-30 18:26:59 -08:00