Hi,
On 2022-09-12 14:44, Nathan Huckleberry wrote:
> The ndo_start_xmit field in net_device_ops is expected to be of type
> netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev).
>
> The mismatched return type breaks forward edge kCFI since the underlying
> function definition does not match the function hook definition.
>
> The return type of sparx5_port_xmit_impl should be changed from int to
> netdev_tx_t.
I noticed that the functions that assign the return value inside
sparx5_port_xmit_impl also have return type int, which would ideally
also be changed. But a bigger issue might be that
sparx5_ptp_txtstamp_request and sparx5_inject (called inside
sparx5_port_xmit_impl) returns -EBUSY (-16), when they should return
NETDEV_TX_BUSY (16). If this is an issue then it also needs to be fixed.
sparx5_fdma_xmit also has int return type, but always returns
NETDEV_TX_OK right now.
Best Regards,
Casper
Hey Casper,
On Tue, Sep 13, 2022 at 1:15 AM Casper Andersson <[email protected]> wrote:
>
> Hi,
>
> On 2022-09-12 14:44, Nathan Huckleberry wrote:
> > The ndo_start_xmit field in net_device_ops is expected to be of type
> > netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev).
> >
> > The mismatched return type breaks forward edge kCFI since the underlying
> > function definition does not match the function hook definition.
> >
> > The return type of sparx5_port_xmit_impl should be changed from int to
> > netdev_tx_t.
>
> I noticed that the functions that assign the return value inside
> sparx5_port_xmit_impl also have return type int, which would ideally
> also be changed. But a bigger issue might be that
> sparx5_ptp_txtstamp_request and sparx5_inject (called inside
> sparx5_port_xmit_impl) returns -EBUSY (-16), when they should return
> NETDEV_TX_BUSY (16). If this is an issue then it also needs to be fixed.
It's not clear to me what happens when returning an error vs
NETDEV_TX_BUSY. The netdev_tx_t enum allows negative values, so
returning an error might be valid. If anyone more familiar with this
code has insight into why it's done like this, that'd be useful.
The important bit here for me is changing the return type on the
hooked function since the current code will cause panics.
>
> sparx5_fdma_xmit also has int return type, but always returns
> NETDEV_TX_OK right now.
>
> Best Regards,
> Casper
>
Thanks,
Huck
On Tue, 13 Sep 2022 10:15:48 +0200 Casper Andersson wrote:
> I noticed that the functions that assign the return value inside
> sparx5_port_xmit_impl also have return type int, which would ideally
> also be changed. But a bigger issue might be that
> sparx5_ptp_txtstamp_request and sparx5_inject (called inside
> sparx5_port_xmit_impl) returns -EBUSY (-16),
Yes, that seems off. IIUC error codes are treated as drops,
but the driver doesn't free the frame. So it's likely a leak.
> when they should return NETDEV_TX_BUSY (16). If this is an issue then
> it also needs to be fixed.