Re: [PATCH 22.11] net/hns3: fix crash for NEON and SVE

[Luca Boccassi <luca.boccassi@gmail.com>]

On Tue, 3 Dec 2024 at 06:53, Jie Hai <haijie1@huawei.com> wrote:
>
> From: Huisong Li <lihuisong@huawei.com>
>
> [ upstream commit 01843ab2f2fc8c3137258ec39b2cb6f62ba7b8a2 ]
>
> Driver may fail to allocate bulk mbufs for Neon and SVE when rearm
> mbuf. Currently, driver keeps going to handle packets even if there
> isn't available descriptors to receive packets at this moment.
> As a result, driver probably fills the mbufs with invalid data to
> application and accesses to illegal address because of the VLD bit
> of the descriptor at the "rx_rearm_start" position still being set.
> So driver has to clear VLD bit for this descriptor in this scenario
> in case of receiving packets later.
>
> In addition, it is possible that the sum of the "rx_rearm_nb" and
> "rx_rearm_start" is greater than total descriptor number of Rx queue
> in the above scenario. So the index of rxq->sw_ring[] to set mbuf
> pointer to NULL should also be fixed to avoid out-of-bounds memory
> access.
>
> Fixes: a3d4f4d291d7 ("net/hns3: support NEON Rx")
> Fixes: f81a18f49152 ("net/hns3: fix mbuf leakage when RxQ started after reset")
>
> Signed-off-by: Huisong Li <lihuisong@huawei.com>
> ---
>  drivers/net/hns3/hns3_rxtx.c         | 2 +-
>  drivers/net/hns3/hns3_rxtx_vec.c     | 5 +++++
>  drivers/net/hns3/hns3_rxtx_vec_sve.c | 5 +++++
>  3 files changed, 11 insertions(+), 1 deletion(-)

Thanks, applied