kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/ethernet/qlogic
History
Shigeru Yoshida a0a558ca7e qede: fix off-by-one in BD ring consumption on build_skb failure 
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.

Commit 4e910dbe36 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.

Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.

Fixes: 8a8633978b ("qede: Add build_skb() support.")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
Link: https://patch.msgid.link/20260630164623.3152625-1-syoshida@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
History 2026-07-06 12:03:10 +02:00
..
netxen Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
qed qed: fix double free in qed_cxt_tables_alloc() 2026-05-21 08:15:00 -07:00
qede qede: fix off-by-one in BD ring consumption on build_skb failure 2026-07-06 12:03:10 +02:00
qlcnic qlcnic: update outdated comment 2026-03-12 19:27:43 -07:00
Kconfig ethernet: fix PTP_1588_CLOCK dependencies 2021-08-13 17:49:05 -07:00
Makefile qlge: Move drivers/net/ethernet/qlogic/qlge/ to drivers/staging/qlge/ 2019-07-23 11:29:40 -07:00
qla3xxx.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
qla3xxx.h net/qla3xxx: Convert to SPDX license identifiers 2020-09-16 14:32:31 +02:00