Patch "octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     octeon_ep-add-skb-allocation-failures-handling-in-__.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 770f4785a39d489a7a88f794a191aca890e85189
Author: Aleksandr Mishin <amishin@xxxxxxxxxx>
Date:   Thu Oct 17 13:06:51 2024 +0300

    octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()
    
    [ Upstream commit eb592008f79be52ccef88cd9a5249b3fc0367278 ]
    
    build_skb() returns NULL in case of a memory allocation failure so handle
    it inside __octep_oq_process_rx() to avoid NULL pointer dereference.
    
    __octep_oq_process_rx() is called during NAPI polling by the driver. If
    skb allocation fails, keep on pulling packets out of the Rx DMA queue: we
    shouldn't break the polling immediately and thus falsely indicate to the
    octep_napi_poll() that the Rx pressure is going down. As there is no
    associated skb in this case, don't process the packets and don't push them
    up the network stack - they are skipped.
    
    Helper function is implemented to unmmap/flush all the fragment buffers
    used by the dropped packet. 'alloc_failures' counter is incremented to
    mark the skb allocation error in driver statistics.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: 37d79d059606 ("octeon_ep: add Tx/Rx processing and interrupt support")
    Suggested-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Aleksandr Mishin <amishin@xxxxxxxxxx>
    Reviewed-by: Jacob Keller <jacob.e.keller@xxxxxxxxx>
    Signed-off-by: Andrew Lunn <andrew@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
index cfbfad95b0211..c7f4e3c058b7f 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
@@ -360,6 +360,27 @@ static void octep_oq_next_pkt(struct octep_oq *oq,
 		*read_idx = 0;
 }
 
+/**
+ * octep_oq_drop_rx() - Free the resources associated with a packet.
+ *
+ * @oq: Octeon Rx queue data structure.
+ * @buff_info: Current packet buffer info.
+ * @read_idx: Current packet index in the ring.
+ * @desc_used: Current packet descriptor number.
+ *
+ */
+static void octep_oq_drop_rx(struct octep_oq *oq,
+			     struct octep_rx_buffer *buff_info,
+			     u32 *read_idx, u32 *desc_used)
+{
+	int data_len = buff_info->len - oq->max_single_buffer_size;
+
+	while (data_len > 0) {
+		octep_oq_next_pkt(oq, buff_info, read_idx, desc_used);
+		data_len -= oq->buffer_size;
+	};
+}
+
 /**
  * __octep_oq_process_rx() - Process hardware Rx queue and push to stack.
  *
@@ -415,6 +436,12 @@ static int __octep_oq_process_rx(struct octep_device *oct,
 		octep_oq_next_pkt(oq, buff_info, &read_idx, &desc_used);
 
 		skb = build_skb((void *)resp_hw, PAGE_SIZE);
+		if (!skb) {
+			octep_oq_drop_rx(oq, buff_info,
+					 &read_idx, &desc_used);
+			oq->stats.alloc_failures++;
+			continue;
+		}
 		skb_reserve(skb, data_offset);
 
 		rx_bytes += buff_info->len;