Re: [PATCH] net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

[Simon Horman <horms@kernel.org>]

On Wed, Mar 18, 2026 at 09:28:41AM +0000, David Carlier wrote:
> cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.
> In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is
> freed via k3_cppi_desc_pool_free() before the psdata pointer is used
> by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].
> This constitutes a use-after-free on every received packet that goes
> through the timestamp path.
> 
> Defer the descriptor free until after all accesses through the psdata
> pointer are complete. For emac_rx_packet(), this means freeing in each
> early-exit path and after emac_rx_timestamp() in the success path. For
> emac_rx_packet_zc(), move the free to the end of the loop body after
> emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned.
> 
> Fixes: 46eeb90f03e0 ("net: ti: icssg-prueth: Use page_pool API for RX buffer allocation")
> Signed-off-by: David Carlier <devnexen@gmail.com>

Hi David,

As a fix for code present in the net tree, this patch should be targeted
at net line this.

Subject: [PATCH net] DAnet: ti: icssg-prueth: ...
                ^^^

Unfortunately our CI tried to apply the patch to the default tree, net-next.
But it doesn't apply there. So the CI didn't run.

Please repost.

-- 
pw-bot: changes-requested