| Message ID | f203fdb6060bb3ba8ff3f27a30767941a4a01c17.1599728755.git.lorenzo@kernel.org |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff | expand |
On Thu, 10 Sep 2020 11:08:01 +0200 Lorenzo Bianconi <lorenzo@kernel.org> wrote: > Release first buffer as last one since it contains references > to subsequent fragments. This code will be optimized introducing > multi-buffer bit in xdp_buff structure. > > Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
From: Lorenzo Bianconi <lorenzo@kernel.org> Date: Thu, 10 Sep 2020 11:08:01 +0200 > Release first buffer as last one since it contains references > to subsequent fragments. This code will be optimized introducing > multi-buffer bit in xdp_buff structure. > > Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Applied, thank you.
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c index dfcb1767acbb..69a900081165 100644 --- a/drivers/net/ethernet/marvell/mvneta.c +++ b/drivers/net/ethernet/marvell/mvneta.c @@ -2029,11 +2029,11 @@ mvneta_xdp_put_buff(struct mvneta_port *pp, struct mvneta_rx_queue *rxq, struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp); int i; - page_pool_put_page(rxq->page_pool, virt_to_head_page(xdp->data), - sync_len, napi); for (i = 0; i < sinfo->nr_frags; i++) page_pool_put_full_page(rxq->page_pool, skb_frag_page(&sinfo->frags[i]), napi); + page_pool_put_page(rxq->page_pool, virt_to_head_page(xdp->data), + sync_len, napi); } static int
Release first buffer as last one since it contains references to subsequent fragments. This code will be optimized introducing multi-buffer bit in xdp_buff structure. Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> --- drivers/net/ethernet/marvell/mvneta.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)