Re: [PATCH net-next v3 6/8] net: xilinx: tsn: add the endpoint RX data path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net: out-of-bounds read of DMA metadata due to missing meta_len check
--

commit 0ae3124fbc7145cd6d9f2c1314d8d1defc3b13e2
Author: Srinivas Neeli <srinivas.neeli@xxxxxxx>

net: xilinx: tsn: add the endpoint RX data path

This commit adds the RX data path for the endpoint to start receiving frames.
It posts RX buffers to the channels and handles inbound frames in a completion
callback. It also serialises the RX refill process against the interface
teardown.

> diff --git a/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c b/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c
> index ab3d6d8cb9440..0a13e04d40575 100644
> --- a/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c
> +++ b/drivers/net/ethernet/xilinx/tsn/xilinx_tsn_ep.c
[ ... ]
> @@ -112,6 +135,181 @@ ep_get_desc(struct xlnx_tsn_ep_dma_chan *xchan, int idx)
>  	return xchan->skb_ring[idx];
>  }
>  
[ ... ]
> +static void ep_dma_rx_cb(void *data, const struct dmaengine_result *result)
> +{
[ ... ]
> +	metadata = dmaengine_desc_get_metadata_ptr(skbuf_dma->desc,
> +						   &meta_len,
> +						   &meta_max_len);
> +	if (IS_ERR_OR_NULL(metadata)) {
> +		if (net_ratelimit())
> +			dev_warn(ep->dev, "Failed to get RX metadata pointer\n");
> +
> +		dev_kfree_skb_any(skb);
> +		DEV_STATS_INC(ndev, rx_dropped);
> +		DEV_STATS_INC(ndev, rx_errors);
> +		goto submit_new;
> +	}
> +
> +	/* MCDMA metadata: [0] = status, [1] = sideband (TID/TDEST/TUSER), [2..] = app */
> +	tuser = metadata[1] & TSN_TUSER_MASK;
                 ^^^^^^^^^^^

[Severity: Medium]
Could this result in an out-of-bounds read if the metadata array is too small?

The driver gets the metadata pointer and its length via meta_len, but it only
validates the pointer using IS_ERR_OR_NULL(). There isn't a check to see if
meta_len is large enough before accessing metadata[1].

If the DMA hardware or backend driver provides fewer than 8 bytes of metadata,
reading from metadata[1] might result in an out-of-bounds access. Should
there be a check that meta_len is at least 2 * sizeof(u32) before accessing
the array?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-patches_v2_external-v3-0-e33d3960ca1e@xxxxxxx?part=6