Re: [PATCH net 0/9] xsk: ZC mbuf fixes

["Björn Töpel" <bjorn@kernel.org>]

Maciej Fijalkowski <maciej.fijalkowski@intel.com> writes:

> Welcome,
>
> Nagato Shiratana reported that duplicate fill ring addresses in aligned
> mode let a driver pass the same buffer to xsk_buff_add_frag() twice.
> This corrupts pool->xskb_list and can lead to a NULL pointer
> dereference in xp_free(). Patch 1 makes xsk_buff_add_frag() reject
> such buffers.
>
> Inspecting the rest of the zero-copy multi-buffer code found more
> issues:
>
> - i40e retries a freed frame, or stalls the queue on a duplicate, when
>   xsk_buff_add_frag() fails (patch 2)
> - ice leaks the buffer when a frag is empty or cannot be added (patch 3)
> - ice and libeth free the frags of a frame still being received when
>   a multi-buffer XDP_TX frame completes (patches 4-5)
> - handing out a duplicate of a frame's head clears its frags flag, so
>   its frags stay on pool->xskb_list and end up in the next frame
>   (patch 6)
> - ice and idpf leak a partially received frame on ring cleanup, and
>   its frags end up in the next frame (patches 8-9)
>
> Patch 7 is Chenguang Zhao's fix for i40e building broken skbs from
> multi-buffer frames. It was posted earlier in an IWL pull request [0]
> and is included here unchanged.
>
> Patches 1 and 6 were tested with KUnit tests based on the reporter's
> reproducer, plus I verified to-be-upstreamed xsk.py test suite passes
> on ice driver (back-to-back setup based on netns) with this set applied.

For the series,

Reviewed-by: Björn Töpel <bjorn@kernel.org>