Commit 8ba3e4c8 authored by Maxim Mikityanskiy's avatar Maxim Mikityanskiy Committed by Saeed Mahameed
Browse files

net/mlx5e: Destroy page pool after XDP SQ to fix use-after-free 



mlx5e_close_xdpsq does the cleanup: it calls mlx5e_free_xdpsq_descs to
free the outstanding descriptors, which relies on
mlx5e_page_release_dynamic and page_pool_release_page. However,
page_pool_destroy is already called by this point, because
mlx5e_close_rq runs before mlx5e_close_xdpsq.

This commit fixes the use-after-free by swapping mlx5e_close_xdpsq and
mlx5e_close_rq.

The commit cited below started calling page_pool_destroy directly from
the driver. Previously, the page pool was destroyed under a call_rcu
from xdp_rxq_info_unreg_mem_model, which would defer the deallocation
until after the XDPSQ is cleaned up.

Fixes: 1da4bbef ("net: core: page_pool: add user refcnt and reintroduce page_pool_destroy")
Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent 6d8680da

drivers/net/ethernet/mellanox/mlx5/core/en_main.c

+10 −10
Original line number Diff line number Diff line
@@ -1891,30 +1891,30 @@ static int mlx5e_open_queues(struct mlx5e_channel *c, 
	if (err)

		goto err_close_icosq;



	err = mlx5e_open_rxq_rq(c, params, &cparam->rq);

	if (err)

		goto err_close_sqs;



	if (c->xdp) {

		err = mlx5e_open_xdpsq(c, params, &cparam->xdp_sq, NULL,

				       &c->rq_xdpsq, false);

		if (err)

			goto err_close_sqs;

			goto err_close_rq;

	}



	err = mlx5e_open_rxq_rq(c, params, &cparam->rq);

	if (err)

		goto err_close_xdp_sq;



	err = mlx5e_open_xdpsq(c, params, &cparam->xdp_sq, NULL, &c->xdpsq, true);

	if (err)

		goto err_close_rq;

		goto err_close_xdp_sq;



	return 0;



err_close_rq:

	mlx5e_close_rq(&c->rq);



err_close_xdp_sq:

	if (c->xdp)

		mlx5e_close_xdpsq(&c->rq_xdpsq);



err_close_rq:

	mlx5e_close_rq(&c->rq);



err_close_sqs:

	mlx5e_close_sqs(c);
@@ -1949,9 +1949,9 @@ static int mlx5e_open_queues(struct mlx5e_channel *c, 
static void mlx5e_close_queues(struct mlx5e_channel *c)

{

	mlx5e_close_xdpsq(&c->xdpsq);

	mlx5e_close_rq(&c->rq);

	if (c->xdp)

		mlx5e_close_xdpsq(&c->rq_xdpsq);

	mlx5e_close_rq(&c->rq);

	mlx5e_close_sqs(c);

	mlx5e_close_icosq(&c->icosq);

	mlx5e_close_icosq(&c->async_icosq);