On Sat, 2023-04-15 at 16:42 +0200, Gerhard Engleder wrote:
> @@ -892,6 +900,37 @@ static int tsnep_rx_desc_available(struct tsnep_rx *rx)
> return rx->read - rx->write - 1;
> }
>
> +static void tsnep_rx_free_page_buffer(struct tsnep_rx *rx)
> +{
> + struct page **page;
> +
> + page = rx->page_buffer;
> + while (*page) {
> + page_pool_put_full_page(rx->page_pool, *page, false);
> + *page = NULL;
> + page++;
> + }
> +}
[...]
> static void tsnep_rx_close(struct tsnep_rx *rx)
> {
> + if (rx->xsk_pool)
> + tsnep_rx_free_page_buffer(rx);
It looks like the above could call tsnep_rx_free_page_buffer() with
each page ptr in rx->page_buffer not zero. If so
tsnep_rx_free_page_buffer() will do an out of bound access.
Also, why testing rx->xsk_pool instead of rx->page_buffer?
Thanks!
Paolo
