From nobody Tue Dec 16 16:41:26 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65A1FC4167B for ; Fri, 1 Dec 2023 14:39:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379200AbjLAOjc (ORCPT ); Fri, 1 Dec 2023 09:39:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1379202AbjLAOj2 (ORCPT ); Fri, 1 Dec 2023 09:39:28 -0500 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E66E171B; Fri, 1 Dec 2023 06:39:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1701441571; x=1732977571; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=t8zt17gleUs6XdyCrQUt22NFtXS6H7COoWrjOZ8T+sc=; b=S5NX34br8AOZqWrnoTha5RmB6Ti7SNlMM5quV1FwhII2MJZVw2ybeBKz hYSEIZI7CsIdCtXVoaWdldwy2jBxk//l3T/+naoUv5hrIDoahc5WJKUw8 xShpCeeQMpu1dZ+bOkxKUs/Yvo8NEPQWNOkR5cU+bmk4PcaYY9Q4Cp6ZH 0y8eo5kB3SE7xW8Pq8V8ErQZZlkJjm5F2/R16jEQ3xHi82wkN3VDwZAma ex88pLiSIf2pbTRqPXFF2tQQmTEX5IeCFUmn1iL1vb2d/99g3zHEp9Px0 FuC9oMgvGI+GdEV9U56URj1i2goXgFkEI0SWeKwSDgAWib1diYCDf9SYF A==; X-IronPort-AV: E=McAfee;i="6600,9927,10911"; a="359144" X-IronPort-AV: E=Sophos;i="6.04,241,1695711600"; d="scan'208";a="359144" Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Dec 2023 06:39:30 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10911"; a="913597561" X-IronPort-AV: E=Sophos;i="6.04,241,1695711600"; d="scan'208";a="913597561" Received: from newjersey.igk.intel.com ([10.102.20.203]) by fmsmga001.fm.intel.com with ESMTP; 01 Dec 2023 06:39:28 -0800 From: Alexander Lobakin To: intel-wired-lan@lists.osuosl.org Cc: Alexander Lobakin , Michal Kubiak , Przemek Kitszel , Maciej Fijalkowski , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH iwl] idpf: fix corrupted frames and skb leaks in singleq mode Date: Fri, 1 Dec 2023 15:38:21 +0100 Message-ID: <20231201143821.1091005-1-aleksander.lobakin@intel.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" idpf_ring::skb serves only for keeping an incomplete frame between several NAPI Rx polling cycles, as one cycle may end up before processing the end of packet descriptor. The pointer is taken from the ring onto the stack before entering the loop and gets written there after the loop exits. When inside the loop, only the onstack pointer is used. For some reason, the logics is broken in the singleq mode, where the pointer is taken from the ring each iteration. This means that if a frame got fragmented into several descriptors, each fragment will have its own skb, but only the last one will be passed up the stack (containing garbage), leaving the rest leaked. Just don't touch the ring skb field inside the polling loop, letting the onstack skb pointer work as expected: build a new skb if it's the first frame descriptor and attach a frag otherwise. Fixes: a5ab9ee0df0b ("idpf: add singleq start_xmit and napi poll") Reviewed-by: Przemek Kitszel Reviewed-by: Michal Kubiak Signed-off-by: Alexander Lobakin Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman --- drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c b/drivers/= net/ethernet/intel/idpf/idpf_singleq_txrx.c index 81288a17da2a..20c4b3a64710 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c +++ b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c @@ -1044,7 +1044,6 @@ static int idpf_rx_singleq_clean(struct idpf_queue *r= x_q, int budget) } =20 idpf_rx_sync_for_cpu(rx_buf, fields.size); - skb =3D rx_q->skb; if (skb) idpf_rx_add_frag(rx_buf, skb, fields.size); else --=20 2.43.0