net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.
In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is
freed via k3_cppi_desc_pool_free() before the psdata pointer is used
by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].
This constitutes a use-after-free on every received packet that goes
through the timestamp path.

Defer the descriptor free until after all accesses through the psdata
pointer are complete. For emac_rx_packet(), move the free into the
requeue label so both early-exit and success paths free the descriptor
after all accesses are done. For emac_rx_packet_zc(), move the free to
the end of the loop body after emac_dispatch_skb_zc() (which calls
emac_rx_timestamp()) has returned.

Fixes: 46eeb90f03e0 ("net: ti: icssg-prueth: Use page_pool API for RX buffer allocation")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260320174439.41080-1-devnexen@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/ti/icssg/icssg_common.c b/drivers/net/ethernet/ti/icssg/icssg_common.c
index 0a3cf2f848a572f65a4e0fd6f8b68d95d436c2d3..fd4e7622f1231bb2513d914210063808911a8369 100644 (file)
--- a/drivers/net/ethernet/ti/icssg/icssg_common.c
+++ b/drivers/net/ethernet/ti/icssg/icssg_common.c
@@ -962,7 +962,6 @@ static int emac_rx_packet_zc(struct prueth_emac *emac, u32 flow_id,
                pkt_len -= 4;
                cppi5_desc_get_tags_ids(&desc_rx->hdr, &port_id, NULL);
                psdata = cppi5_hdesc_get_psdata(desc_rx);
-               k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
                count++;
                xsk_buff_set_size(xdp, pkt_len);
                xsk_buff_dma_sync_for_cpu(xdp);
@@ -988,6 +987,7 @@ static int emac_rx_packet_zc(struct prueth_emac *emac, u32 flow_id,
                        emac_dispatch_skb_zc(emac, xdp, psdata);
                        xsk_buff_free(xdp);
                }
+               k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
        }
 
        if (xdp_status & ICSSG_XDP_REDIR)
@@ -1057,7 +1057,6 @@ static int emac_rx_packet(struct prueth_emac *emac, u32 flow_id, u32 *xdp_state)
        /* firmware adds 4 CRC bytes, strip them */
        pkt_len -= 4;
        cppi5_desc_get_tags_ids(&desc_rx->hdr, &port_id, NULL);
-       k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
 
        /* if allocation fails we drop the packet but push the
         * descriptor back to the ring with old page to prevent a stall
@@ -1115,6 +1114,7 @@ static int emac_rx_packet(struct prueth_emac *emac, u32 flow_id, u32 *xdp_state)
        ndev->stats.rx_packets++;
 
 requeue:
+       k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
        /* queue another RX DMA */
        ret = prueth_dma_rx_push_mapped(emac, &emac->rx_chns, new_page,
                                        PRUETH_MAX_PKT_SIZE);