Patch "net: renesas: rswitch: fix possible early skb release" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: renesas: rswitch: fix possible early skb release

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-renesas-rswitch-fix-possible-early-skb-release.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 57cbeb68793bc58579168fd56ad00fc64cf6178e
Author: Nikita Yushchenko <nikita.yoush@xxxxxxxxxxxxxxxxxx>
Date:   Sun Dec 8 14:50:01 2024 +0500

    net: renesas: rswitch: fix possible early skb release
    
    [ Upstream commit 5cb099902b6b6292b3a85ffa1bb844e0ba195945 ]
    
    When sending frame split into multiple descriptors, hardware processes
    descriptors one by one, including writing back DT values. The first
    descriptor could be already marked as completed when processing of
    next descriptors for the same frame is still in progress.
    
    Although only the last descriptor is configured to generate interrupt,
    completion of the first descriptor could be noticed by the driver when
    handling interrupt for the previous frame.
    
    Currently, driver stores skb in the entry that corresponds to the first
    descriptor. This results into skb could be unmapped and freed when
    hardware did not complete the send yet. This opens a window for
    corrupting the data being sent.
    
    Fix this by saving skb in the entry that corresponds to the last
    descriptor used to send the frame.
    
    Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX")
    Signed-off-by: Nikita Yushchenko <nikita.yoush@xxxxxxxxxxxxxxxxxx>
    Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@xxxxxxxxxxx>
    Link: https://patch.msgid.link/20241208095004.69468-2-nikita.yoush@xxxxxxxxxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
index 54aa56c84133..2f483531d95c 100644
--- a/drivers/net/ethernet/renesas/rswitch.c
+++ b/drivers/net/ethernet/renesas/rswitch.c
@@ -1632,8 +1632,9 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd
 	if (dma_mapping_error(ndev->dev.parent, dma_addr_orig))
 		goto err_kfree;
 
-	gq->skbs[gq->cur] = skb;
-	gq->unmap_addrs[gq->cur] = dma_addr_orig;
+	/* Stored the skb at the last descriptor to avoid skb free before hardware completes send */
+	gq->skbs[(gq->cur + nr_desc - 1) % gq->ring_size] = skb;
+	gq->unmap_addrs[(gq->cur + nr_desc - 1) % gq->ring_size] = dma_addr_orig;
 
 	dma_wmb();