diff options
| author | Lorenzo Bianconi <lorenzo@kernel.org> | 2020-09-10 12:08:01 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-09-11 01:03:49 +0300 |
| commit | 9d3b2d3e4942cb82630f0d638de4b2253c0af56d (patch) | |
| tree | 4c0a9b1f46a0406d52e89652547bc1fb236e7bcc /drivers/net/ethernet/marvell | |
| parent | 5bf490e6807bf56f49b5991b4be817407dd32656 (diff) | |
| download | linux-9d3b2d3e4942cb82630f0d638de4b2253c0af56d.tar.xz | |
net: mvneta: fix possible use-after-free in mvneta_xdp_put_buff
Release first buffer as last one since it contains references
to subsequent fragments. This code will be optimized introducing
multi-buffer bit in xdp_buff structure.
Fixes: ca0e014609f05 ("net: mvneta: move skb build after descriptors processing")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/marvell')
| -rw-r--r-- | drivers/net/ethernet/marvell/mvneta.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c index dfcb1767acbb..69a900081165 100644 --- a/drivers/net/ethernet/marvell/mvneta.c +++ b/drivers/net/ethernet/marvell/mvneta.c @@ -2029,11 +2029,11 @@ mvneta_xdp_put_buff(struct mvneta_port *pp, struct mvneta_rx_queue *rxq, struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp); int i; - page_pool_put_page(rxq->page_pool, virt_to_head_page(xdp->data), - sync_len, napi); for (i = 0; i < sinfo->nr_frags; i++) page_pool_put_full_page(rxq->page_pool, skb_frag_page(&sinfo->frags[i]), napi); + page_pool_put_page(rxq->page_pool, virt_to_head_page(xdp->data), + sync_len, napi); } static int |