]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
authorWei Fang <wei.fang@nxp.com>
Wed, 20 May 2026 06:44:18 +0000 (14:44 +0800)
committerJakub Kicinski <kuba@kernel.org>
Thu, 21 May 2026 15:48:59 +0000 (08:48 -0700)
commitadb4599979cd00d5d426f26cf78b65264217e35b
treeb9abb7c1efafb17867c267b8acf8371c51d43f9c
parentf262f5d893327a7131ed25ac8dd01ed7024bcc18
net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()

The teardown sequence in enetc_msg_psi_free() frees the DMA buffer before
clearing the device's DMA address registers. If a VF sends a message or a
pending DMA transfer completes within this window, the hardware will
perform a DMA write into the kernel memory that has already been returned
to the allocator.

The result is silent memory corruption that can affect arbitrary kernel
data structures. Therefore, clear the DMA address registers before the
DMA buffer is freed.

Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/20260520064421.91569-7-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/freescale/enetc/enetc_msg.c