git.openwrt.org Git - openwrt/staging/stintel.git/blob

   1 From 0cf39c6543469aae4a30cba354243125514ed568 Mon Sep 17 00:00:00 2001
   2 From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
   3 Date: Wed, 29 Mar 2023 13:11:17 +0100
   4 Subject: [PATCH] net: mvneta: fix potential double-frees in
   5  mvneta_txq_sw_deinit()
   6
   7 Reported on the Turris forum, mvneta provokes kernel warnings in the
   8 architecture DMA mapping code when mvneta_setup_txqs() fails to
   9 allocate memory. This happens because when mvneta_cleanup_txqs() is
  10 called in the mvneta_stop() path, we leave pointers in the structure
  11 that have been freed.
  12
  13 Then on mvneta_open(), we call mvneta_setup_txqs(), which starts
  14 allocating memory. On memory allocation failure, mvneta_cleanup_txqs()
  15 will walk all the queues freeing any non-NULL pointers - which includes
  16 pointers that were previously freed in mvneta_stop().
  17
  18 Fix this by setting these pointers to NULL to prevent double-freeing
  19 of the same memory.
  20
  21 Link: https://forum.turris.cz/t/random-kernel-exceptions-on-hbl-tos-7-0/18865/8
  22 Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
  23 ---
  24  drivers/net/ethernet/marvell/mvneta.c | 2 ++
  25  1 file changed, 2 insertions(+)
  26
  27 --- a/drivers/net/ethernet/marvell/mvneta.c
  28 +++ b/drivers/net/ethernet/marvell/mvneta.c
  29 @@ -3481,6 +3481,8 @@ static void mvneta_txq_sw_deinit(struct
  30
  31         netdev_tx_reset_queue(nq);
  32
  33 +       txq->buf               = NULL;
  34 +       txq->tso_hdrs          = NULL;
  35         txq->descs             = NULL;
  36         txq->last_desc         = 0;
  37         txq->next_desc_to_proc = 0;