* [PATCH net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff
@ 2020-09-10 9:08 Lorenzo Bianconi
2020-09-10 12:23 ` Jesper Dangaard Brouer
2020-09-10 22:04 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Lorenzo Bianconi @ 2020-09-10 9:08 UTC (permalink / raw)
To: netdev; +Cc: lorenzo.bianconi, davem, kuba, thomas.petazzoni, brouer, echaudro
Release first buffer as last one since it contains references
to subsequent fragments. This code will be optimized introducing
multi-buffer bit in xdp_buff structure.
Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/ethernet/marvell/mvneta.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index dfcb1767acbb..69a900081165 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -2029,11 +2029,11 @@ mvneta_xdp_put_buff(struct mvneta_port *pp, struct mvneta_rx_queue *rxq,
struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp);
int i;
- page_pool_put_page(rxq->page_pool, virt_to_head_page(xdp->data),
- sync_len, napi);
for (i = 0; i < sinfo->nr_frags; i++)
page_pool_put_full_page(rxq->page_pool,
skb_frag_page(&sinfo->frags[i]), napi);
+ page_pool_put_page(rxq->page_pool, virt_to_head_page(xdp->data),
+ sync_len, napi);
}
static int
--
2.26.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff
2020-09-10 9:08 [PATCH net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff Lorenzo Bianconi
@ 2020-09-10 12:23 ` Jesper Dangaard Brouer
2020-09-10 22:04 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Jesper Dangaard Brouer @ 2020-09-10 12:23 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: brouer, netdev, lorenzo.bianconi, davem, kuba, thomas.petazzoni,
echaudro
On Thu, 10 Sep 2020 11:08:01 +0200
Lorenzo Bianconi <lorenzo@kernel.org> wrote:
> Release first buffer as last one since it contains references
> to subsequent fragments. This code will be optimized introducing
> multi-buffer bit in xdp_buff structure.
>
> Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff
2020-09-10 9:08 [PATCH net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff Lorenzo Bianconi
2020-09-10 12:23 ` Jesper Dangaard Brouer
@ 2020-09-10 22:04 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2020-09-10 22:04 UTC (permalink / raw)
To: lorenzo; +Cc: netdev, lorenzo.bianconi, kuba, thomas.petazzoni, brouer,
echaudro
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Thu, 10 Sep 2020 11:08:01 +0200
> Release first buffer as last one since it contains references
> to subsequent fragments. This code will be optimized introducing
> multi-buffer bit in xdp_buff structure.
>
> Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Applied, thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-09-10 22:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-10 9:08 [PATCH net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff Lorenzo Bianconi
2020-09-10 12:23 ` Jesper Dangaard Brouer
2020-09-10 22:04 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).