Re: [PATCH net-next 2/2] net: atlantic: convert RX path to page_pool

On 7/10/26 7:38 PM, sashiko-bot@kernel.org wrote:

quoted

+		return -ENOMEM;
+	}
 
-	if (!rxbuf->rxdata.page) {
-		ret = aq_alloc_rxpages(&rxbuf->rxdata, self);
-		if (ret) {
-			u64_stats_update_begin(&self->stats.rx.syncp);
-			self->stats.rx.alloc_fails++;
-			u64_stats_update_end(&self->stats.rx.syncp);
-		}
-		return ret;
-	}
+	rxbuf->rxdata.page = page;
+	rxbuf->rxdata.daddr = page_pool_get_dma_addr(page);
+	rxbuf->rxdata.pg_off = pg_off + self->page_offset;

[Severity: Critical]
Can this cause severe DMA memory corruption during RX buffer refill?

The initialization of buff->pa appears to be missing or was removed here,
but the hardware callback still executes immediately after and
unconditionally overwrites the descriptor's physical address:

hw_atl_b0_hw_ring_rx_fill() {
    ...
    rxd->buf_addr = buff->pa;
    rxd->hdr_addr = 0U;
    ...
}

FTR, AFAICS the above is AI sloop (and quite an unexpected one!) as
buff->pa is actually always initialized by:

	buff->pa = aq_buf_daddr(&buff->rxdata);

that comes after the aq_get_rxpages() call. All other issues are
pre-existing ones.

/P