lkml.org 
[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 002/108] igb: Fix use-after-free error during reset
    Date
    From: Vinicius Costa Gomes <vinicius.gomes@intel.com>

    [ Upstream commit 7b292608db23ccbbfbfa50cdb155d01725d7a52e ]

    Cleans the next descriptor to watch (next_to_watch) when cleaning the
    TX ring.

    Failure to do so can cause invalid memory accesses. If igb_poll() runs
    while the controller is reset this can lead to the driver try to free
    a skb that was already freed.

    (The crash is harder to reproduce with the igb driver, but the same
    potential problem exists as the code is identical to igc)

    Fixes: 7cc6fd4c60f2 ("igb: Don't bother clearing Tx buffer_info in igb_clean_tx_ring")
    Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
    Reported-by: Erez Geva <erez.geva.ext@siemens.com>
    Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
    index c37f0590b3a4..09f2338084e7 100644
    --- a/drivers/net/ethernet/intel/igb/igb_main.c
    +++ b/drivers/net/ethernet/intel/igb/igb_main.c
    @@ -4657,6 +4657,8 @@ static void igb_clean_tx_ring(struct igb_ring *tx_ring)
    DMA_TO_DEVICE);
    }

    + tx_buffer->next_to_watch = NULL;
    +
    /* move us one more past the eop_desc for start of next pkt */
    tx_buffer++;
    i++;
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-26 18:04    [W:4.256 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site