Patch "net: ena: Set tx_info->xdpf value to NULL" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: ena: Set tx_info->xdpf value to NULL

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-ena-set-tx_info-xdpf-value-to-null.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6c63816c12792528c866b132e8a0c705a8cd80eb
Author: David Arinzon <darinzon@xxxxxxxxxx>
Date:   Wed Apr 10 09:13:58 2024 +0000

    net: ena: Set tx_info->xdpf value to NULL
    
    [ Upstream commit 36a1ca01f0452f2549420e7279c2588729bd94df ]
    
    The patch mentioned in the `Fixes` tag removed the explicit assignment
    of tx_info->xdpf to NULL with the justification that there's no need
    to set tx_info->xdpf to NULL and tx_info->num_of_bufs to 0 in case
    of a mapping error. Both values won't be used once the mapping function
    returns an error, and their values would be overridden by the next
    transmitted packet.
    
    While both values do indeed get overridden in the next transmission
    call, the value of tx_info->xdpf is also used to check whether a TX
    descriptor's transmission has been completed (i.e. a completion for it
    was polled).
    
    An example scenario:
    1. Mapping failed, tx_info->xdpf wasn't set to NULL
    2. A VF reset occurred leading to IO resource destruction and
       a call to ena_free_tx_bufs() function
    3. Although the descriptor whose mapping failed was freed by the
       transmission function, it still passes the check
         if (!tx_info->skb)
    
       (skb and xdp_frame are in a union)
    4. The xdp_frame associated with the descriptor is freed twice
    
    This patch returns the assignment of NULL to tx_info->xdpf to make the
    cleaning function knows that the descriptor is already freed.
    
    Fixes: 504fd6a5390c ("net: ena: fix DMA mapping function issues in XDP")
    Signed-off-by: Shay Agroskin <shayagr@xxxxxxxxxx>
    Signed-off-by: David Arinzon <darinzon@xxxxxxxxxx>
    Reviewed-by: Shannon Nelson <shannon.nelson@xxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/amazon/ena/ena_xdp.c b/drivers/net/ethernet/amazon/ena/ena_xdp.c
index 363e361cc5aa8..25de2f511649f 100644
--- a/drivers/net/ethernet/amazon/ena/ena_xdp.c
+++ b/drivers/net/ethernet/amazon/ena/ena_xdp.c
@@ -89,7 +89,7 @@ int ena_xdp_xmit_frame(struct ena_ring *tx_ring,
 
 	rc = ena_xdp_tx_map_frame(tx_ring, tx_info, xdpf, &ena_tx_ctx);
 	if (unlikely(rc))
-		return rc;
+		goto err;
 
 	ena_tx_ctx.req_id = req_id;
 
@@ -112,7 +112,9 @@ int ena_xdp_xmit_frame(struct ena_ring *tx_ring,
 
 error_unmap_dma:
 	ena_unmap_tx_buff(tx_ring, tx_info);
+err:
 	tx_info->xdpf = NULL;
+
 	return rc;
 }