net/mlx5e: Fix use-after-free after xdp_return_frame (12fc512f) · Commits · 戴 / test

xdp_return_frame releases the frame. It leads to releasing the page, so it's not allowed to access xdpi.xdpf->len after that, because xdpi.xdpf is at xdp->data_hard_start after convert_to_xdp_frame. This patch moves the memory access to precede the return of the frame. Fixes: ("net/mlx5e: Add support for XDP_REDIRECT in device-out side") Signed-off-by:

Maxim Mikityanskiy <maximmi@mellanox.com> Signed-off-by:

Saeed Mahameed <saeedm@mellanox.com>

drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -304,9 +304,9 @@ bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq cq, struct mlx5e_rq rq)
		mlx5e_xdpi_fifo_pop(xdpi_fifo);

		if (is_redirect) {
		xdp_return_frame(xdpi.xdpf);
		dma_unmap_single(sq->pdev, xdpi.dma_addr,
		xdpi.xdpf->len, DMA_TO_DEVICE);
		xdp_return_frame(xdpi.xdpf);
		} else {
		/* Recycle RX page */
		mlx5e_page_release(rq, &xdpi.di, true);
		@@ -345,9 +345,9 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq sq, struct mlx5e_rq rq)
		mlx5e_xdpi_fifo_pop(xdpi_fifo);

		if (is_redirect) {
		xdp_return_frame(xdpi.xdpf);
		dma_unmap_single(sq->pdev, xdpi.dma_addr,
		xdpi.xdpf->len, DMA_TO_DEVICE);
		xdp_return_frame(xdpi.xdpf);
		} else {
		/* Recycle RX page */
		mlx5e_page_release(rq, &xdpi.di, false);

Admin message