Re: [PATCH v2] net/mlx4_en: fix potential use-after-free with dma_unmap_page

[David Miller <davem@davemloft.net>]

From: Sarah Newman <srn@prgmr.com>
Date: Wed, 25 Apr 2018 21:00:34 -0700

> When swiotlb is in use, calling dma_unmap_page means that
> the original page mapped with dma_map_page must still be valid
> as swiotlb will copy data from its internal cache back to the
> originally requested DMA location. When GRO is enabled,
> all references to the original frag may be put before
> mlx4_en_free_frag is called, meaning the page has been freed
> before the call to dma_unmap_page in mlx4_en_free_frag.
> 
> To fix, unmap the page as soon as possible.
> 
> This can be trivially detected by doing the following:
> 
> Compile the kernel with DEBUG_PAGEALLOC
> Run the kernel as a Xen Dom0
> Leave GRO enabled on the interface
> Run a 10 second or more test with iperf over the interface.
> 
> Signed-off-by: Sarah Newman <srn@prgmr.com>

Tariq, I assume I will get this from you in the next set of
changes you submit to me.

Thanks.