netdev - Re: [PATCH net] net: libwx: fix double put of page to page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250702143152.6046ab7c@kernel.org>
Date: Wed, 2 Jul 2025 14:31:52 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Jiawen Wu <jiawenwu@...stnetic.com>
Cc: netdev@...r.kernel.org, andrew+netdev@...n.ch, davem@...emloft.net,
 edumazet@...gle.com, pabeni@...hat.com, horms@...nel.org,
 mengyuanlou@...-swift.com, duanqiangwen@...-swift.com,
 stable@...r.kernel.org
Subject: Re: [PATCH net] net: libwx: fix double put of page to page_pool

On Mon, 30 Jun 2025 17:41:02 +0800 Jiawen Wu wrote:
> wx_dma_sync_frag() incorrectly attempted to return the page to
> page_pool, which is already handled via buffer reuse or wx_build_skb()
> paths.

The conditions is:

	if (unlikely(WX_CB(skb)->page_released))

And only wx_put_rx_buffer() sets that to true.  And it sets page to
NULL, so I don't understand how this is supposed to work.

Please improve the commit message, if not the code..

> Under high MTU and high throughput, this causes list corruption
> inside page_pool due to double free.
> 
> [  876.949950] Call Trace:
> [  876.949951]  <IRQ>
> [  876.949952]  __rmqueue_pcplist+0x53/0x2c0
> [  876.949955]  alloc_pages_bulk_noprof+0x2e0/0

This is just the stack trace you're missing the earlier lines which
tell us what problem happened and where.
-- 
pw-bot: cr