Commit 14449093 authored by Heiner Kallweit's avatar Heiner Kallweit Committed by Liu Jian
Browse files

r8169: remove nr_frags argument from rtl_tx_slots_avail 

mainline inclusion
from mainline-v5.11-rc1
commit 83c317d7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SF4
CVE: CVE-2024-38586

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83c317d7b36bb3858cf1cb86d2635ec3f3bd6ea3



---------------------------

The only time when nr_frags isn't SKB_MAX_FRAGS is when entering
rtl8169_start_xmit(). However we can use SKB_MAX_FRAGS also here
because when queue isn't stopped there should always be room for
MAX_SKB_FRAGS + 1 descriptors.

Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/3d1f2ad7-31d5-2cac-4f4a-394f8a3cab63@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 2b51dc89

drivers/net/ethernet/realtek/r8169_main.c

+6 −9
Original line number Diff line number Diff line
@@ -4253,14 +4253,13 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, 
	return true;

}



static bool rtl_tx_slots_avail(struct rtl8169_private *tp,

			       unsigned int nr_frags)

static bool rtl_tx_slots_avail(struct rtl8169_private *tp)

{

	unsigned int slots_avail = READ_ONCE(tp->dirty_tx) + NUM_TX_DESC

					- READ_ONCE(tp->cur_tx);



	/* A skbuff with nr_frags needs nr_frags+1 entries in the tx queue */

	return slots_avail > nr_frags;

	return slots_avail > MAX_SKB_FRAGS;

}



/* Versions RTL8102e and from RTL8168c onwards support csum_v2 */
@@ -4295,7 +4294,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, 


	txd_first = tp->TxDescArray + entry;



	if (unlikely(!rtl_tx_slots_avail(tp, frags))) {

	if (unlikely(!rtl_tx_slots_avail(tp))) {

		if (net_ratelimit())

			netdev_err(dev, "BUG! Tx Ring full when queue awake!\n");

		goto err_stop_0;
@@ -4340,7 +4339,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, 


	WRITE_ONCE(tp->cur_tx, tp->cur_tx + frags + 1);



	stop_queue = !rtl_tx_slots_avail(tp, MAX_SKB_FRAGS);

	stop_queue = !rtl_tx_slots_avail(tp);

	if (unlikely(stop_queue)) {

		/* Avoid wrongly optimistic queue wake-up: rtl_tx thread must

		 * not miss a ring update when it notices a stopped queue.
@@ -4355,7 +4354,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, 
		 * can't.

		 */

		smp_mb__after_atomic();

		if (rtl_tx_slots_avail(tp, MAX_SKB_FRAGS))

		if (rtl_tx_slots_avail(tp))

			netif_start_queue(dev);

		door_bell = true;

	}
@@ -4509,10 +4508,8 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, 
		 * ring status.

		 */

		smp_store_mb(tp->dirty_tx, dirty_tx);

		if (netif_queue_stopped(dev) &&

		    rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) {

		if (netif_queue_stopped(dev) && rtl_tx_slots_avail(tp))

			netif_wake_queue(dev);

		}

		/*

		 * 8168 hack: TxPoll requests are lost when the Tx packets are

		 * too close. Let's kick an extra TxPoll request when a burst