net: fix stale TX skb pointers on DMA map failure

[PATCH net v1 0/3] net: fix stale TX skb pointers on DMA map failure

Posted by xuanqiang.luo@linux.dev 2 weeks, 1 day ago

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

While I was backporting commit 1a303baa715e6 ("ice: fix double-free of
tx_buf skb"), an AI-assisted scan identified several suspected TX error
paths. I reviewed the results and found this issue in the three drivers
fixed here.

The drivers differ, but the bug is the same. On a DMA mapping failure, the
TX path frees an skb while its ring entry still points to it. A later
transmission normally overwrites the entry. If the interface is stopped
first, teardown can instead access or free the skb again.

I do not have these adapters, so I have not tested the drivers on hardware.
I checked the error and teardown paths by inspection. Still, these small
fixes seem worth posting for review. They are independent, but are sent as
one series because they address the same issue.

Xuanqiang Luo (3):
  bna: fix use-after-free on DMA mapping failure
  hinic3: fix use-after-free on DMA mapping failure
  net: hibmcge: fix double-free of tx skb on DMA mapping failure

 drivers/net/ethernet/brocade/bna/bnad.c           | 2 +-
 drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 1 +
 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c    | 5 +++--
 3 files changed, 5 insertions(+), 3 deletions(-)

-- 
2.43.0

Re: [PATCH net v1 0/3] net: fix stale TX skb pointers on DMA map failure

Posted by Simon Horman 1 week, 2 days ago

On Fri, Jul 10, 2026 at 05:05:21PM +0800, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> While I was backporting commit 1a303baa715e6 ("ice: fix double-free of
> tx_buf skb"), an AI-assisted scan identified several suspected TX error
> paths. I reviewed the results and found this issue in the three drivers
> fixed here.
> 
> The drivers differ, but the bug is the same. On a DMA mapping failure, the
> TX path frees an skb while its ring entry still points to it. A later
> transmission normally overwrites the entry. If the interface is stopped
> first, teardown can instead access or free the skb again.
> 
> I do not have these adapters, so I have not tested the drivers on hardware.
> I checked the error and teardown paths by inspection. Still, these small
> fixes seem worth posting for review. They are independent, but are sent as
> one series because they address the same issue.
> 
> Xuanqiang Luo (3):
>   bna: fix use-after-free on DMA mapping failure
>   hinic3: fix use-after-free on DMA mapping failure
>   net: hibmcge: fix double-free of tx skb on DMA mapping failure

For the series:

Reviewed-by: Simon Horman <horms@kernel.org>