[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 5.4 002/108] igb: Fix use-after-free error during reset
    From: Vinicius Costa Gomes <>

    [ Upstream commit 7b292608db23ccbbfbfa50cdb155d01725d7a52e ]

    Cleans the next descriptor to watch (next_to_watch) when cleaning the
    TX ring.

    Failure to do so can cause invalid memory accesses. If igb_poll() runs
    while the controller is reset this can lead to the driver try to free
    a skb that was already freed.

    (The crash is harder to reproduce with the igb driver, but the same
    potential problem exists as the code is identical to igc)

    Fixes: 7cc6fd4c60f2 ("igb: Don't bother clearing Tx buffer_info in igb_clean_tx_ring")
    Signed-off-by: Vinicius Costa Gomes <>
    Reported-by: Erez Geva <>
    Tested-by: Tony Brelinski <>
    Signed-off-by: Tony Nguyen <>
    Signed-off-by: Sasha Levin <>
    drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
    index c37f0590b3a4..09f2338084e7 100644
    --- a/drivers/net/ethernet/intel/igb/igb_main.c
    +++ b/drivers/net/ethernet/intel/igb/igb_main.c
    @@ -4657,6 +4657,8 @@ static void igb_clean_tx_ring(struct igb_ring *tx_ring)

    + tx_buffer->next_to_watch = NULL;
    /* move us one more past the eop_desc for start of next pkt */

     \ /
      Last update: 2021-07-26 18:04    [W:4.837 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site