From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5514D386554; Mon, 23 Mar 2026 14:58:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774277904; cv=none; b=S4jp60zjU7JhROu053lZwdGbZXfTyCYTc/jIK1yo1d0h7RpOeVl42DW5Qh4JwpMZDKDLjvX1aJG/o49uFlvLK9yQbwqd7fhRV7ya6/vlPl2hjDwELD8qcCgm6nf5zRkdYgtDj/tGY58D8lf1uBKqxnfltr+5qQUdLbszEbCId1I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774277904; c=relaxed/simple; bh=q2BSjUe8LewONTvvxADYGtUCIE2vYwuTxcS57t5/0hE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fnN4qegBirm6FFs2cinT8vG7gIMRDdfsvcie/kY6mX4p3IQKRZV1BlqCCt7FG8+WD93u9KJcIxuaofI2ieqo7r7CQLJyI01PhoxApS3qWgITpm+3DP0do83LGdzXS7JE5Up+VWP1jaVuqhVWZ+oD5Zx23PrgeZr7Bt4jUB9rZNA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=j0ozM7M2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="j0ozM7M2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF074C4CEF7; Mon, 23 Mar 2026 14:58:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774277904; bh=q2BSjUe8LewONTvvxADYGtUCIE2vYwuTxcS57t5/0hE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j0ozM7M2OOog+p9VBb1ofzoT3c5Fcj1ysBhZOM4nVv97qtOzMvKvVFumRjzy0Cydl 5yEPGpUn+FVdKvX7eVwShnqCTvWDluL/gBiJll2iYyd71y9moLyWWNzYBoQFcCPKku D1JnycNwosgSxjMB+aiTXmc/PZrEe50xyVifWcN4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Maciej Fijalkowski , "Nikhil P. Rao" , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 137/567] xsk: Fix fragment node deletion to prevent buffer leak Date: Mon, 23 Mar 2026 14:40:57 +0100 Message-ID: <20260323134537.193813149@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260323134533.749096647@linuxfoundation.org> References: <20260323134533.749096647@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nikhil P. Rao [ Upstream commit 60abb0ac11dccd6b98fd9182bc5f85b621688861 ] After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node is reinitialized after removal, allowing the list_empty() to work correctly. Fixes: b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node") Acked-by: Maciej Fijalkowski Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260225000456.107806-2-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski Stable-dep-of: f7387d6579d6 ("xsk: Fix zero-copy AF_XDP fragment drop") Signed-off-by: Sasha Levin --- include/net/xdp_sock_drv.h | 6 +++--- net/xdp/xsk.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/net/xdp_sock_drv.h b/include/net/xdp_sock_drv.h index 7be51bdd9c63a..91339ffd2f2a8 100644 --- a/include/net/xdp_sock_drv.h +++ b/include/net/xdp_sock_drv.h @@ -115,7 +115,7 @@ static inline void xsk_buff_free(struct xdp_buff *xdp) goto out; list_for_each_entry_safe(pos, tmp, xskb_list, list_node) { - list_del(&pos->list_node); + list_del_init(&pos->list_node); xp_free(pos); } @@ -140,7 +140,7 @@ static inline struct xdp_buff *xsk_buff_get_frag(struct xdp_buff *first) frag = list_first_entry_or_null(&xskb->pool->xskb_list, struct xdp_buff_xsk, list_node); if (frag) { - list_del(&frag->list_node); + list_del_init(&frag->list_node); ret = &frag->xdp; } @@ -151,7 +151,7 @@ static inline void xsk_buff_del_tail(struct xdp_buff *tail) { struct xdp_buff_xsk *xskb = container_of(tail, struct xdp_buff_xsk, xdp); - list_del(&xskb->list_node); + list_del_init(&xskb->list_node); } static inline struct xdp_buff *xsk_buff_get_tail(struct xdp_buff *first) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 8ccc2f2a99d97..8f3971a94d967 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -179,7 +179,7 @@ static int xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) err = __xsk_rcv_zc(xs, pos, len, contd); if (err) goto err; - list_del(&pos->list_node); + list_del_init(&pos->list_node); } return 0; -- 2.51.0