Skip to content

Commit 1ce50d8

Browse files
committed
net/mlx5e: SHAMPO, Fix incorrect page release
jira LE-3064 cve CVE-2024-46717 Rebuild_History Non-Buildable kernel-4.18.0-553.53.1.el8_10 commit-author Dragos Tatulea <[email protected]> commit 70bd03b Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once. Signed-off-by: Dragos Tatulea <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 70bd03b) Signed-off-by: Jonathan Maple <[email protected]>
1 parent 9fa44c7 commit 1ce50d8

File tree

1 file changed

+2
-1
lines changed
  • drivers/net/ethernet/mellanox/mlx5/core

1 file changed

+2
-1
lines changed

drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2117,7 +2117,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cq
21172117
if (flush)
21182118
mlx5e_shampo_flush_skb(rq, cqe, match);
21192119
free_hd_entry:
2120-
mlx5e_free_rx_shampo_hd_entry(rq, header_index);
2120+
if (likely(head_size))
2121+
mlx5e_free_rx_shampo_hd_entry(rq, header_index);
21212122
mpwrq_cqe_out:
21222123
if (likely(wi->consumed_strides < rq->mpwqe.num_strides))
21232124
return;

0 commit comments

Comments
 (0)