Skip to content

Commit 1632872

Browse files
committed
net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
jira LE-3064 cve CVE-2024-44970 Rebuild_History Non-Buildable kernel-4.18.0-553.53.1.el8_10 commit-author Dragos Tatulea <[email protected]> commit fba8334 When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again. Signed-off-by: Dragos Tatulea <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit fba8334) Signed-off-by: Jonathan Maple <[email protected]>
1 parent 1ce50d8 commit 1632872

File tree

1 file changed

+3
-0
lines changed
  • drivers/net/ethernet/mellanox/mlx5/core

1 file changed

+3
-0
lines changed

drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2123,6 +2123,9 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cq
21232123
if (likely(wi->consumed_strides < rq->mpwqe.num_strides))
21242124
return;
21252125

2126+
if (unlikely(!cstrides))
2127+
return;
2128+
21262129
wq = &rq->mpwqe.wq;
21272130
wqe = mlx5_wq_ll_get_wqe(wq, wqe_id);
21282131
mlx5e_free_rx_mpwqe(rq, wi, true);

0 commit comments

Comments
 (0)