Commit 27d597a4 authored by Dragos Tatulea's avatar Dragos Tatulea Committed by Liu Jian
Browse files

net/mlx5e: SHAMPO, Fix incorrect page release 

stable inclusion
from stable-v6.6.50
commit ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV2G
CVE: CVE-2024-46717

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab



-------------------------------------------------

[ Upstream commit 70bd03b89f20b9bbe51a7f73c4950565a17a45f7 ]

Under the following conditions:
1) No skb created yet
2) header_size == 0 (no SHAMPO header)
3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the
   last page fragment of a SHAMPO header page)

a new skb is formed with a page that is NOT a SHAMPO header page (it
is a regular data page). Further down in the same function
(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from
header_index is released. This is wrong and it leads to SHAMPO header
pages being released more than once.

Signed-off-by: default avatarDragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: default avatarTariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/r/20240603212219.1037656-3-tariqt@nvidia.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 734745d1

drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

+2 −1
Original line number Diff line number Diff line
@@ -2369,6 +2369,7 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cq 
	if (flush)

		mlx5e_shampo_flush_skb(rq, cqe, match);

free_hd_entry:

	if (likely(head_size))

		mlx5e_free_rx_shampo_hd_entry(rq, header_index);

mpwrq_cqe_out:

	if (likely(wi->consumed_strides < rq->mpwqe.num_strides))