Commit d3ca078f authored by Jesper Dangaard Brouer's avatar Jesper Dangaard Brouer Committed by Zhang Zekun
Browse files

xen-netfront: Add missing skb_mark_for_recycle 

mainline inclusion
from mainline-v6.9-rc3
commit 037965402a010898d34f4e35327d22c0a95cd51f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9O0MS
CVE: CVE-2024-27393

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=037965402a010898d34f4e35327d22c0a95cd51f



-------------------------------------------------

Notice that skb_mark_for_recycle() is introduced later than fixes tag in
commit 6a5bcd84 ("page_pool: Allow drivers to hint on SKB recycling").

It is believed that fixes tag were missing a call to page_pool_release_page()
between v5.9 to v5.14, after which is should have used skb_mark_for_recycle().
Since v6.6 the call page_pool_release_page() were removed (in
commit 535b9c61 ("net: page_pool: hide page_pool_release_page()")
and remaining callers converted (in commit 6bfef2ec ("Merge branch
'net-page_pool-remove-page_pool_release_page'")).

This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch
page_pool memory leaks").

Cc: stable@vger.kernel.org
Fixes: 6c5aa6fc ("xen networking: add basic XDP support for xen-netfront")
Reported-by: default avatarLeonidas Spyropoulos <artafinde@archlinux.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218654


Reported-by: default avatarArthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: default avatarJesper Dangaard Brouer <hawk@kernel.org>
Link: https://lore.kernel.org/r/171154167446.2671062.9127105384591237363.stgit@firesoul


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarZhang Zekun <zhangzekun11@huawei.com>
parent 83e8197d

drivers/net/xen-netfront.c

+1 −0
Original line number Diff line number Diff line
@@ -287,6 +287,7 @@ static struct sk_buff *xennet_alloc_one_rx_buffer(struct netfront_queue *queue) 
		return NULL;

	}

	skb_add_rx_frag(skb, 0, page, 0, 0, PAGE_SIZE);

	skb_mark_for_recycle(skb);



	/* Align ip header to a 16 bytes boundary */

	skb_reserve(skb, NET_IP_ALIGN);