tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.
In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is
freed via k3_cppi_desc_pool_free() before the psdata pointer is used
by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].
This constitutes a use-after-free on every received packet that goes
through the timestamp path.

Defer the descriptor free until after all accesses through the psdata
pointer are complete. For emac_rx_packet(), move the free into the
requeue label so both early-exit and success paths free the descriptor
after all accesses are done. For emac_rx_packet_zc(), move the free to
the end of the loop body after emac_dispatch_skb_zc() (which calls
emac_rx_timestamp()) has returned.

Fixes: 46eeb90f03e0 ("net: ti: icssg-prueth: Use page_pool API for RX buffer allocation")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260320174439.41080-1-devnexen@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

David Carlier and committed by
Paolo Abeni eb8c426c 25f5463c

+2 -2
+2 -2
drivers/net/ethernet/ti/icssg/icssg_common.c
··· 962 962 pkt_len -= 4; 963 963 cppi5_desc_get_tags_ids(&desc_rx->hdr, &port_id, NULL); 964 964 psdata = cppi5_hdesc_get_psdata(desc_rx); 965 - k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx); 966 965 count++; 967 966 xsk_buff_set_size(xdp, pkt_len); 968 967 xsk_buff_dma_sync_for_cpu(xdp); ··· 987 988 emac_dispatch_skb_zc(emac, xdp, psdata); 988 989 xsk_buff_free(xdp); 989 990 } 991 + k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx); 990 992 } 991 993 992 994 if (xdp_status & ICSSG_XDP_REDIR) ··· 1057 1057 /* firmware adds 4 CRC bytes, strip them */ 1058 1058 pkt_len -= 4; 1059 1059 cppi5_desc_get_tags_ids(&desc_rx->hdr, &port_id, NULL); 1060 - k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx); 1061 1060 1062 1061 /* if allocation fails we drop the packet but push the 1063 1062 * descriptor back to the ring with old page to prevent a stall ··· 1114 1115 ndev->stats.rx_packets++; 1115 1116 1116 1117 requeue: 1118 + k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx); 1117 1119 /* queue another RX DMA */ 1118 1120 ret = prueth_dma_rx_push_mapped(emac, &emac->rx_chns, new_page, 1119 1121 PRUETH_MAX_PKT_SIZE);