This is a note to let you know that I've just added the patch titled
net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 64f14d16eef1f939000f2617b50c7c996b5117d4 Mon Sep 17 00:00:00 2001
From: Rahul Rameshbabu <rrameshbabu@xxxxxxxxxx>
Date: Tue, 14 Nov 2023 13:58:40 -0800
Subject: net/mlx5e: Avoid referencing skb after free-ing in drop path of mlx5e_sq_xmit_wqe
From: Rahul Rameshbabu <rrameshbabu@xxxxxxxxxx>
commit 64f14d16eef1f939000f2617b50c7c996b5117d4 upstream.
When SQ is a port timestamping SQ for PTP, do not access tx flags of skb
after free-ing the skb. Free the skb only after all references that depend
on it have been handled in the dropped WQE path.
Fixes: 3178308ad4ca ("net/mlx5e: Make tx_port_ts logic resilient to out-of-order CQEs")
Signed-off-by: Rahul Rameshbabu <rrameshbabu@xxxxxxxxxx>
Reviewed-by: Tariq Toukan <tariqt@xxxxxxxxxx>
Signed-off-by: Saeed Mahameed <saeedm@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20231114215846.5902-10-saeed@xxxxxxxxxx
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -494,10 +494,10 @@ mlx5e_sq_xmit_wqe(struct mlx5e_txqsq *sq
err_drop:
stats->dropped++;
- dev_kfree_skb_any(skb);
if (unlikely(sq->ptpsq && (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)))
mlx5e_ptp_metadata_fifo_push(&sq->ptpsq->metadata_freelist,
be32_to_cpu(eseg->flow_table_metadata));
+ dev_kfree_skb_any(skb);
mlx5e_tx_flush(sq);
}
Patches currently in stable-queue which might be from rrameshbabu@xxxxxxxxxx are
queue-6.5/net-mlx5e-track-xmit-submission-to-ptp-wq-after-populating-metadata-map.patch
queue-6.5/net-mlx5e-add-recovery-flow-for-tx-devlink-health-re.patch
queue-6.5/net-mlx5-decouple-phc-.adjtime-and-.adjphase-impleme.patch
queue-6.5/net-mlx5-consolidate-devlink-documentation-in-devlin.patch
queue-6.5/net-mlx5e-make-tx_port_ts-logic-resilient-to-out-of-.patch
queue-6.5/net-mlx5-increase-size-of-irq-name-buffer.patch
queue-6.5/net-mlx5e-avoid-referencing-skb-after-free-ing-in-drop-path-of-mlx5e_sq_xmit_wqe.patch
queue-6.5/net-mlx5e-update-doorbell-for-port-timestamping-cq-b.patch
queue-6.5/net-mlx5e-check-return-value-of-snprintf-writing-to-.patch
queue-6.5/net-mlx5e-check-return-value-of-snprintf-writing-to-.patch-24193
