Skip to content

net: lan966x: fix page_pool error handling and error paths

David Carlier lkml netdev stable 3 versions – Applied

Status from this message: This series was applied to netdev/net.git (main)

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v3 Latest3 patches 0 repliesApplied 3/3
  2. v23 patches 2 repliesSuperseded
  3. v11 patch 2 repliesSuperseded

Patches in v3 All 3 applied

#Subject and filesSizeRepliesApplied
1/3net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c+2 -00 repliesApplied
2/3net: lan966x: fix page pool leak in error pathsdrivers/net/ethernet/microchip/lan966x/lan966x_fdma.c+4 -10 repliesApplied
3/3net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c+18 -30 repliesApplied

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v3 yet.

Read the v3 thread

Cover letter [PATCH net v3 0/3] net: lan966x: fix page_pool error handling and error paths

This series fixes error handling around the lan966x page pool:

1/3 adds the missing IS_ERR check after page_pool_create(), preventing
a kernel oops when the error pointer flows into xdp_rxq_info_reg_mem_model().

2/3 plugs page pool leaks in the lan966x_fdma_rx_alloc() and
lan966x_fdma_init() error paths, now reachable after 1/3.

3/3 fixes a use-after-free and page pool leak in the
lan966x_fdma_reload() restore path, where the hardware could resume DMA into pages already returned to the page pool.

David Carlier (3):
net: lan966x: fix page_pool error handling in

    lan966x_fdma_rx_alloc_page_pool()

net: lan966x: fix page pool leak in error paths
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

 .../ethernet/microchip/lan966x/lan966x_fdma.c | 28 ++++++++++++++++---
 1 file changed, 24 insertions(+), 4 deletions(-)
Signature · 10 lines
v2 -> v3:                                                                                                                                                             
    - 1/3: remove blank line between page_pool_create() and IS_ERR check (Jakub)
    - 2/3: drop rx->page_pool = NULL for consistency with lan966x_fdma_init()                                                                                           
           cleanup; update commit message accordingly (Jakub)                                                                                                           
    - 3/3: remove blank line between kmemdup() and !old_pages check (Jakub)                                                                                             
  v1 -> v2: address caller error paths raised by Jakub's review; add patches                                                                                            
           2/3 and 3/3                                                                                                                                                  
  v1: https://lore.kernel.org/netdev/[email protected]                                                                           
  v2: https://lore.kernel.org/netdev/[email protected]
2.53.0