netdev - Re: [PATCH net v2] net: ethernet: mtk_eth_soc: fix memory leak in LRO rings release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZrorEoWOoe8inWcx@makrotopia.org>
Date: Mon, 12 Aug 2024 16:32:34 +0100
From: Daniel Golle <daniel@...rotopia.org>
To: Elad Yifee <eladwf@...il.com>
Cc: Felix Fietkau <nbd@....name>, Sean Wang <sean.wang@...iatek.com>,
	Mark Lee <Mark-MC.Lee@...iatek.com>,
	Lorenzo Bianconi <lorenzo@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Matthias Brugger <matthias.bgg@...il.com>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
	Chen Lin <chen45464546@....com>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
	linux-mediatek@...ts.infradead.org
Subject: Re: [PATCH net v2] net: ethernet: mtk_eth_soc: fix memory leak in
 LRO rings release

On Mon, Aug 12, 2024 at 06:21:19PM +0300, Elad Yifee wrote:
> For LRO we allocate more than one page, yet 'skb_free_frag' is used
> to free the buffer, which only frees a single page.
> Fix it by using 'free_pages' instead.
> 
> Fixes: 2f2c0d2919a1 ("net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag")
> Signed-off-by: Elad Yifee <eladwf@...il.com>
> ---
> v2: fixed compilation warnings
> ---
>  drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> index 16ca427cf4c3..e25b552d70f7 100644
> --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
> @@ -1762,8 +1762,10 @@ static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi)
>  	if (ring->page_pool)
>  		page_pool_put_full_page(ring->page_pool,
>  					virt_to_head_page(data), napi);
> -	else
> +	else if (ring->frag_size <= PAGE_SIZE)
>  		skb_free_frag(data);
> +	else
> +		free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size)));
You miss on open '(' there. Won't even compile like that.
Please always compile- and run-time test patches before sending them
to the mailing list.

>  }
>  
>  static int mtk_xdp_frame_map(struct mtk_eth *eth, struct net_device *dev,
> @@ -2132,7 +2134,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
>  				ring->buf_size, DMA_FROM_DEVICE);
>  			if (unlikely(dma_mapping_error(eth->dma_dev,
>  						       dma_addr))) {
> -				skb_free_frag(new_data);
> +				mtk_rx_put_buff(ring, new_data, true);
>  				netdev->stats.rx_dropped++;
>  				goto release_desc;
>  			}
> @@ -2146,7 +2148,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
>  			skb = build_skb(data, ring->frag_size);
>  			if (unlikely(!skb)) {
>  				netdev->stats.rx_dropped++;
> -				skb_free_frag(data);
> +				mtk_rx_put_buff(ring, data, true);
>  				goto skip_rx;
>  			}
>  
> @@ -2691,7 +2693,7 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
>  				ring->buf_size, DMA_FROM_DEVICE);
>  			if (unlikely(dma_mapping_error(eth->dma_dev,
>  						       dma_addr))) {
> -				skb_free_frag(data);
> +				mtk_rx_put_buff(ring, data, false);
>  				return -ENOMEM;
>  			}
>  		}
> -- 
> 2.45.2
>