1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
linux/drivers/net/ethernet/intel/idpf
Alexander Lobakin 290f1c0332 idpf: fix UAFs when destroying the queues
The second tagged commit started sometimes (very rarely, but possible)
throwing WARNs from
net/core/page_pool.c:page_pool_disable_direct_recycling().
Turned out idpf frees interrupt vectors with embedded NAPIs *before*
freeing the queues making page_pools' NAPI pointers lead to freed
memory before these pools are destroyed by libeth.
It's not clear whether there are other accesses to the freed vectors
when destroying the queues, but anyway, we usually free queue/interrupt
vectors only when the queues are destroyed and the NAPIs are guaranteed
to not be referenced anywhere.

Invert the allocation and freeing logic making queue/interrupt vectors
be allocated first and freed last. Vectors don't require queues to be
present, so this is safe. Additionally, this change allows to remove
that useless queue->q_vector pointer cleanup, as vectors are still
valid when freeing the queues (+ both are freed within one function,
so it's not clear why nullify the pointers at all).

Fixes: 1c325aac10 ("idpf: configure resources for TX queues")
Fixes: 90912f9f4f ("idpf: convert header split mode to libeth + napi_build_skb()")
Reported-by: Michal Kubiak <michal.kubiak@intel.com>
Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Link: https://patch.msgid.link/20240806220923.3359860-4-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-08-07 20:26:55 -07:00
..
idpf.h idpf: use libeth Rx buffer management for payload buffer 2024-07-10 10:48:45 -07:00
idpf_controlq.c idpf: fix minor controlq issues 2024-03-04 09:48:33 -08:00
idpf_controlq.h idpf: add controlq init and reset checks 2023-09-13 14:59:23 -07:00
idpf_controlq_api.h idpf: implement virtchnl transaction manager 2024-03-04 09:32:41 -08:00
idpf_controlq_setup.c idpf: add controlq init and reset checks 2023-09-13 14:59:23 -07:00
idpf_dev.c idpf: add idpf_virtchnl.h 2024-03-04 09:28:27 -08:00
idpf_devids.h idpf: add module register and probe functionality 2023-09-13 14:59:23 -07:00
idpf_ethtool.c idpf: remove legacy Page Pool Ethtool stats 2024-07-10 10:44:59 -07:00
idpf_lan_pf_regs.h idpf: initialize interrupts and enable vport 2023-09-13 14:59:24 -07:00
idpf_lan_txrx.h idpf: stop using macros for accessing queue descriptors 2024-07-10 10:31:28 -07:00
idpf_lan_vf_regs.h idpf: initialize interrupts and enable vport 2023-09-13 14:59:24 -07:00
idpf_lib.c idpf: fix UAFs when destroying the queues 2024-08-07 20:26:55 -07:00
idpf_main.c idpf: reuse libeth's definitions of parsed ptype structures 2024-07-10 10:43:57 -07:00
idpf_mem.h idpf: add controlq init and reset checks 2023-09-13 14:59:23 -07:00
idpf_singleq_txrx.c idpf: use libeth Rx buffer management for payload buffer 2024-07-10 10:48:45 -07:00
idpf_txrx.c idpf: fix UAFs when destroying the queues 2024-08-07 20:26:55 -07:00
idpf_txrx.h idpf: use libeth Rx buffer management for payload buffer 2024-07-10 10:48:45 -07:00
idpf_vf_dev.c idpf: implement virtchnl transaction manager 2024-03-04 09:32:41 -08:00
idpf_virtchnl.c idpf: use libeth Rx buffer management for payload buffer 2024-07-10 10:48:45 -07:00
idpf_virtchnl.h idpf: refactor idpf_recv_mb_msg 2024-03-04 09:39:30 -08:00
Kconfig idpf: use libeth Rx buffer management for payload buffer 2024-07-10 10:48:45 -07:00
Makefile idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ 2024-07-10 10:42:26 -07:00
virtchnl2.h idpf: sprinkle __counted_by{,_le}() in the virtchnl2 header 2024-03-28 18:50:47 -07:00
virtchnl2_lan_desc.h