Skip to content

Commit f5a094b

Browse files
committed
net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
jira LE-2157 cve CVE-2024-44970 Rebuild_History Non-Buildable kernel-5.14.0-503.14.1.el9_5 commit-author Dragos Tatulea <[email protected]> commit fba8334 When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again. Signed-off-by: Dragos Tatulea <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit fba8334) Signed-off-by: Jonathan Maple <[email protected]>
1 parent a0a0578 commit f5a094b

File tree

1 file changed

+3
-0
lines changed
  • drivers/net/ethernet/mellanox/mlx5/core

1 file changed

+3
-0
lines changed

drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2376,6 +2376,9 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cq
23762376
if (likely(wi->consumed_strides < rq->mpwqe.num_strides))
23772377
return;
23782378

2379+
if (unlikely(!cstrides))
2380+
return;
2381+
23792382
wq = &rq->mpwqe.wq;
23802383
wqe = mlx5_wq_ll_get_wqe(wq, wqe_id);
23812384
mlx5_wq_ll_pop(wq, cqe->wqe_id, &wqe->next.next_wqe_index);

0 commit comments

Comments
 (0)