From nobody Sun Jul 26 01:45:24 2026 Received: from out-174.mta0.migadu.com (out-174.mta0.migadu.com [91.218.175.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 411B63D45E6 for ; Fri, 10 Jul 2026 09:07:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783674438; cv=none; b=kG7oxH90Aqp3hHFZTFf/rQJrmeXC+TOY1q16wcwIv++sMsCuAvR4oOoY3uwKLGLXkAkCzvpeKA8X3S+OLssuUfa0xVlErWP5TTFXmEFF0hj87/vqOKJm8TpnXrajjkNAg2SMNBqJ3ijRcpmbHc9bncdigdlm+2KbzM+P9D1r3BE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783674438; c=relaxed/simple; bh=jHmMQll1ae+qhtp0WSZs4AaXAT0OmttERPZUaIEX7ds=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PB7/RnRP1CLwVSx3M723NE/1/rY7d2gpv7nMIxhvSjr69FFGNGAruQtkV5dWd4mID4+3osJM6tr6Bax6wODMEOKaWtQ3NmO3XPyzp0yTziBemkyiv+7wXPIqxZZRUiL+8gh4gyEJHeGRlzT5k+ad6eV+hOiJu3Et9a/OuJa/loA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=xsSEjR12; arc=none smtp.client-ip=91.218.175.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="xsSEjR12" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1783674435; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IXP2s9du0gXWzN+9G9A/aXarqaLKl1ksW2pNWjl9v/E=; b=xsSEjR12R3IRD07Zjk/jDFreAGmdxN3wrXTDR3M5+KgG3GTZLarVoWQVnwInBIS4NlpNzC KPDO4nGRTYVDZmujBS3gU4EXcRxvj1awW0bXauPygKHulywdWIwTJhPXXKpKv3HOl1ZGS3 oU6HthHGxxo73mC/VZK/4d/+egiW/5A= From: xuanqiang.luo@linux.dev To: netdev@vger.kernel.org Cc: Xuanqiang Luo , Rasesh Mody , Sudarsana Kalluru , GR-Linux-NIC-Dev@marvell.com, Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Ivan Vecera , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v1 1/3] bna: fix use-after-free on DMA mapping failure Date: Fri, 10 Jul 2026 17:05:22 +0800 Message-ID: <20260710090527.58354-2-xuanqiang.luo@linux.dev> In-Reply-To: <20260710090527.58354-1-xuanqiang.luo@linux.dev> References: <20260710090527.58354-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo If dma_map_single() fails in bnad_start_xmit(), the skb is freed, but head_unmap->skb was set before the mapping attempt and is not cleared. The producer index is not advanced, so later transmissions normally overwrite the entry. However, if the interface is brought down first, bnad_txq_cleanup() scans the entire unmap queue, finds the stale pointer, and calls bnad_tx_buff_unmap() on it. That function dereferences the freed skb in skb_headlen(). Its zero nvecs count is decremented to -1, causing its while (nvecs) loop to repeatedly unmap entries around the TX ring and potentially hang cleanup. Set head_unmap->skb after the first DMA mapping succeeds. This prevents the stale entry from reaching bnad_tx_buff_unmap(). Fixes: ba5ca7848be0 ("bna: check for dma mapping errors") Cc: stable@vger.kernel.org Assisted-by: Opencode:deepseek-v4-pro[1m] Signed-off-by: Xuanqiang Luo Reviewed-by: Simon Horman --- drivers/net/ethernet/brocade/bna/bnad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet= /brocade/bna/bnad.c index 8e19add764db2..8b75004ba7c9d 100644 --- a/drivers/net/ethernet/brocade/bna/bnad.c +++ b/drivers/net/ethernet/brocade/bna/bnad.c @@ -3006,7 +3006,6 @@ bnad_start_xmit(struct sk_buff *skb, struct net_devic= e *netdev) txqent->hdr.wi.reserved =3D 0; txqent->hdr.wi.num_vectors =3D vectors; =20 - head_unmap->skb =3D skb; head_unmap->nvecs =3D 0; =20 /* Program the vectors */ @@ -3018,6 +3017,7 @@ bnad_start_xmit(struct sk_buff *skb, struct net_devic= e *netdev) BNAD_UPDATE_CTR(bnad, tx_skb_map_failed); return NETDEV_TX_OK; } + head_unmap->skb =3D skb; BNA_SET_DMA_ADDR(dma_addr, &txqent->vector[0].host_addr); txqent->vector[0].length =3D htons(len); dma_unmap_addr_set(&unmap->vectors[0], dma_addr, dma_addr); --=20 2.43.0 From nobody Sun Jul 26 01:45:24 2026 Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C27043DB96B for ; Fri, 10 Jul 2026 09:07:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783674443; cv=none; b=N8IFyKbU1o9Hj84kI5d4uLlofBl6bz4k8loZv9416TlCHBmyPX/bxnSwdi85Y8P5UQx8heXyLmNE1gTdTWZVnBWHlpktTo5d9VhodSEzJb9sYMOisDkTSnyS0oeL9fV+qDIOfwP4BVjRpE76aNxCf3V6iBI7ArCNTw0EV774pUk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783674443; c=relaxed/simple; bh=fmTL2s8F/eTQj2Mtdl4MWB8rAQdRaiVlgmFFyz9i54U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eYc2IjbKotB4EQ2t7Gfs7C9xUf2irpECsLko+b1KZwh91j0imeCfAOEu6YOZj57kNExZ9uZlY4Y1ceP3zfqYL2Uw8ZROMbBuf7Ri5nG6rk27zMPQ9iDkxAZyG4yd5luQbuiT856qxjkyI5C5t8nC7FPHBSTp3C8DF3IzuBzDa2A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=YckP22k1; arc=none smtp.client-ip=91.218.175.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="YckP22k1" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1783674439; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=o5M72C3L1ZgsFmb5gY5mJ3SoLciOzkeobaXpGracEas=; b=YckP22k162bNqNEwPV8+gIbiLDri+6utRarOwGdBGHydCMHlfPgo8vyxD7+Hanf3loiA/X v2TNFkuFvqopkH2ss2issDBHGonfMFoxOx37z8uno9EpwagzBuAjnKTz9eJ8clOFlH12Gq irMwCq3cl7R2gi2OAAs7wTcRxT3jLyE= From: xuanqiang.luo@linux.dev To: netdev@vger.kernel.org Cc: Xuanqiang Luo , Fan Gong , Xin Guo , Gur Stavi , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v1 2/3] hinic3: fix use-after-free on DMA mapping failure Date: Fri, 10 Jul 2026 17:05:23 +0800 Message-ID: <20260710090527.58354-3-xuanqiang.luo@linux.dev> In-Reply-To: <20260710090527.58354-1-xuanqiang.luo@linux.dev> References: <20260710090527.58354-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo If hinic3_tx_map_skb() fails in hinic3_send_one_skb(), the skb is freed, but tx_info->skb was set before the mapping attempt and is not cleared. The SQ producer index is rolled back, so later transmissions normally overwrite the entry. If the interface is brought down first, hinic3_free_txqs_res() calls free_all_tx_skbs(). It scans the entire tx_info array and finds the stale pointer. hinic3_tx_unmap_skb() then dereferences the freed skb in skb_shinfo(), before it is freed again. Set tx_info->skb and its WQEBB count only after DMA mapping succeeds, preventing the stale pointer from reaching free_all_tx_skbs(). Fixes: 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic") Cc: stable@vger.kernel.org Assisted-by: Opencode:deepseek-v4-pro[1m] Signed-off-by: Xuanqiang Luo Reviewed-by: Fan Gong Reviewed-by: Simon Horman --- drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c b/drivers/net/e= thernet/huawei/hinic3/hinic3_tx.c index 9306bf0020caf..5739ecb08d0d3 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c @@ -578,8 +578,6 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *= skb, *wqe_combo.task =3D task; =20 tx_info =3D &txq->tx_info[pi]; - tx_info->skb =3D skb; - tx_info->wqebb_cnt =3D wqebb_cnt; =20 err =3D hinic3_tx_map_skb(netdev, skb, txq, tx_info, &wqe_combo); if (err) { @@ -589,6 +587,9 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *= skb, goto err_drop_pkt; } =20 + tx_info->skb =3D skb; + tx_info->wqebb_cnt =3D wqebb_cnt; + netif_subqueue_sent(netdev, txq->sq->q_id, skb->len); netif_subqueue_maybe_stop(netdev, txq->sq->q_id, hinic3_wq_free_wqebbs(&txq->sq->wq), --=20 2.43.0 From nobody Sun Jul 26 01:45:24 2026 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B96BC3DCDAB for ; Fri, 10 Jul 2026 09:07:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783674448; cv=none; b=lhVCzWLU8zEkp+6JEM0exh9F9n0gWBlWj4T59cvpeDsDyb4ZVMlIHoBtC+nHLTI3z97biD5/zH8WGHT3qfxNHT9wKoY/NWgtCRQ/w86h/4WOHBhdHEVLu2673Ox7QDw6Z+GwUA0eqk/1SIYcUpz03YuXSy1WvVHZvLsnktZVHBY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783674448; c=relaxed/simple; bh=uQghfOMqAieaXWL/V/uyqBHu+tBty5j/FwnMUNMlkbM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fUyCzwrKfA0iN///jM7a6p5e/R3zBNJjs9KQUyvIlEzGxT2qF7Wf1L7rNGEQYwxMg36B72SbEMV4P9UrWSajr2CQkwKjIf8ITHd+I6X/FyIE3RLiaBOyS0MHisagD5nYa8MGQOCq3hPxMH4Mgk5rxEFB7bAkWJX986nfjMqO4W0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=W/YbU15y; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="W/YbU15y" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1783674444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NfXFXrSXL0Osw1K5e7Mta9NtqrS2eZ1FPVYi2bwW7oU=; b=W/YbU15yRz/pi+a8R8q9I/nBnE351cXsCRPwg2aBJIPpXp1voELDyTWSEk00/+fhGpoOon 8RZsW14x/evZUEdqK8O7IqzIVuYlTswmUWPSWEr1zPtP9RBFbIrBtmHD0epbMg7BMXj5nB ih0ISAB3WxCWhhii7vDJJtbcokiyZpo= From: xuanqiang.luo@linux.dev To: netdev@vger.kernel.org Cc: Xuanqiang Luo , Jijie Shao , Jian Shen , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v1 3/3] net: hibmcge: fix double-free of tx skb on DMA mapping failure Date: Fri, 10 Jul 2026 17:05:24 +0800 Message-ID: <20260710090527.58354-4-xuanqiang.luo@linux.dev> In-Reply-To: <20260710090527.58354-1-xuanqiang.luo@linux.dev> References: <20260710090527.58354-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo If hbg_dma_map() fails, hbg_net_start_xmit() frees the skb, but buffer->skb is left pointing to it. ring->ntu is not advanced, so the buffer is not visible to the TX cleanup path. A subsequent transmit normally overwrites the buffer. However, if the interface is brought down first, hbg_ring_uninit() calls hbg_buffer_free(). It sees the stale pointer, attempts to unmap the failed mapping, and frees the skb again. Clear buffer->skb before freeing the skb in the error path, preventing hbg_buffer_free() from treating it as an outstanding TX buffer. Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function") Cc: stable@vger.kernel.org Assisted-by: Opencode:deepseek-v4-pro[1m] Signed-off-by: Xuanqiang Luo Reviewed-by: Jijie Shao Reviewed-by: Simon Horman --- drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c b/drivers/ne= t/ethernet/hisilicon/hibmcge/hbg_txrx.c index 0ae3149946769..4382af937e2e7 100644 --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c @@ -155,6 +155,7 @@ netdev_tx_t hbg_net_start_xmit(struct sk_buff *skb, str= uct net_device *netdev) buffer->skb =3D skb; buffer->skb_len =3D skb->len; if (unlikely(hbg_dma_map(buffer))) { + buffer->skb =3D NULL; dev_kfree_skb_any(skb); return NETDEV_TX_OK; } --=20 2.43.0