From: Brelinski, TonyX <tonyx.brelinski@intel.com>
To: intel-wired-lan@osuosl.org
Subject: [Intel-wired-lan] [PATCH net-queue v1 2/2] igb: Fix user-after-free error during reset
Date: Fri, 25 Jun 2021 22:37:30 +0000 [thread overview]
Message-ID: <SJ0PR11MB5662A51872F9209E87C30217FA069@SJ0PR11MB5662.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20210514003104.1360697-2-vinicius.gomes@intel.com>
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
> Vinicius Costa Gomes
> Sent: Thursday, May 13, 2021 5:31 PM
> To: intel-wired-lan at lists.osuosl.org
> Cc: erez.geva.ext at siemens.com
> Subject: [Intel-wired-lan] [PATCH net-queue v1 2/2] igb: Fix user-after-free
> error during reset
>
> Cleans the next descriptor to watch (next_to_watch) when cleaning the TX
> ring.
>
> Failure to do so can cause invalid memory accesses. If igc_poll() runs while
> the controller is reset this can lead to the driver try to free a skb that was
> already freed.
>
> (The crash is harder to reproduce with the igb driver, but the same potential
> problem exists as the code is identical to igc)
>
> Fixes: 7cc6fd4c60f2 ("igb: Don't bother clearing Tx buffer_info in
> igb_clean_tx_ring")
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
> Reported-by: Erez Geva <erez.geva.ext@siemens.com>
> ---
> drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
> 1 file changed, 2 insertions(+)
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com> (A Contingent Worker at Intel)
next prev parent reply other threads:[~2021-06-25 22:37 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-14 0:31 [Intel-wired-lan] [PATCH net-queue v1 1/2] igc: Fix user-after-free error during reset Vinicius Costa Gomes
2021-05-14 0:31 ` [Intel-wired-lan] [PATCH net-queue v1 2/2] igb: " Vinicius Costa Gomes
2021-06-25 22:37 ` Brelinski, TonyX [this message]
2021-06-02 9:52 ` [Intel-wired-lan] [PATCH net-queue v1 1/2] igc: " Dvora Fuxbrumer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=SJ0PR11MB5662A51872F9209E87C30217FA069@SJ0PR11MB5662.namprd11.prod.outlook.com \
--to=tonyx.brelinski@intel.com \
--cc=intel-wired-lan@osuosl.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.