> -----Original Message----- > From: Intel-wired-lan <[email protected]> On Behalf Of > Alexander Lobakin > Sent: Monday, December 11, 2023 4:32 AM > To: [email protected] > Cc: Fijalkowski, Maciej <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; [email protected]; Lobakin, > Aleksander <[email protected]>; Eric Dumazet > <[email protected]>; Kubiak, Michal <[email protected]>; > Simon Horman <[email protected]>; [email protected]; Jakub > Kicinski <[email protected]>; Paolo Abeni <[email protected]>; David S. > Miller <[email protected]> > Subject: [Intel-wired-lan] [PATCH iwl-net v2] idpf: fix corrupted frames and > skb leaks in singleq mode > > idpf_ring::skb serves only for keeping an incomplete frame between > several NAPI Rx polling cycles, as one cycle may end up before > processing the end of packet descriptor. The pointer is taken from > the ring onto the stack before entering the loop and gets written > there after the loop exits. When inside the loop, only the onstack > pointer is used. > For some reason, the logics is broken in the singleq mode, where the > pointer is taken from the ring each iteration. This means that if a > frame got fragmented into several descriptors, each fragment will have > its own skb, but only the last one will be passed up the stack > (containing garbage), leaving the rest leaked. > Then, on ifdown, rxq::skb is being freed only in the splitq mode, while > it can point to a valid skb in singleq as well. This can lead to a yet > another skb leak. > Just don't touch the ring skb field inside the polling loop, letting > the onstack skb pointer work as expected: build a new skb if it's the > first frame descriptor and attach a frag otherwise. On ifdown, free > rxq::skb unconditionally if the pointer is non-NULL. > > Fixes: a5ab9ee0df0b ("idpf: add singleq start_xmit and napi poll") > Reviewed-by: Przemek Kitszel <[email protected]> > Reviewed-by: Michal Kubiak <[email protected]> > Reviewed-by: Simon Horman <[email protected]> > Reviewed-by: Eric Dumazet <[email protected]> > Signed-off-by: Alexander Lobakin <[email protected]> > --- > Tony, please add it to dev-queue instead of the first revision. > > From v1[0]: > * fix the related skb leak on ifdown; > * fix subject prefix; > * pick Reviewed-bys. > > [0] https://lore.kernel.org/all/20231201143821.1091005-1- > [email protected] > --- > drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 1 - > drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +- > 2 files changed, 1 insertion(+), 2 deletions(-)
Tested-by: Scott Register <[email protected]> _______________________________________________ Intel-wired-lan mailing list [email protected] https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
