net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

commit 59c3d55a946cacdb4181600723c20ac4f4c20c84 upstream.

When lan966x_fdma_reload() fails to allocate new RX buffers, the restore
path restarts DMA using old descriptors whose pages were already freed
via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can
release pages back to the buddy allocator, the hardware may DMA into
memory now owned by other kernel subsystems.

Additionally, on the restore path, the newly created page pool (if
allocation partially succeeded) is overwritten without being destroyed,
leaking it.

Fix both issues by deferring the release of old pages until after the
new allocation succeeds. Save the old page array before the allocation
so old pages can be freed on the success path. On the failure path, the
old descriptors, pages and page pool are all still valid, making the
restore safe. Also ensure the restore path re-enables NAPI and wakes
the netdev, matching the success path.

Fixes: 89ba464fcf54 ("net: lan966x: refactor buffer reload function")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260405055241.35767-4-devnexen@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
index e5d88e098fbba05a7ad7c6f65048019e57bfbd4f..646f3d65274e3cda35e15de7a73b87727819c687 100644 (file)
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
@@ -813,9 +813,15 @@ static int lan966x_qsys_sw_status(struct lan966x *lan966x)
 
 static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
 {
+       struct page *(*old_pages)[FDMA_RX_DCB_MAX_DBS];
        struct page_pool *page_pool;
        struct fdma fdma_rx_old;
-       int err;
+       int err, i, j;
+
+       old_pages = kmemdup(lan966x->rx.page, sizeof(lan966x->rx.page),
+                          GFP_KERNEL);
+       if (!old_pages)
+               return -ENOMEM;
 
        /* Store these for later to free them */
        memcpy(&fdma_rx_old, &lan966x->rx.fdma, sizeof(struct fdma));
@@ -826,7 +832,6 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
        lan966x_fdma_stop_netdev(lan966x);
 
        lan966x_fdma_rx_disable(&lan966x->rx);
-       lan966x_fdma_rx_free_pages(&lan966x->rx);
        lan966x->rx.page_order = round_up(new_mtu, PAGE_SIZE) / PAGE_SIZE - 1;
        lan966x->rx.max_mtu = new_mtu;
        err = lan966x_fdma_rx_alloc(&lan966x->rx);
@@ -834,6 +839,11 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
                goto restore;
        lan966x_fdma_rx_start(&lan966x->rx);
 
+       for (i = 0; i < fdma_rx_old.n_dcbs; ++i)
+               for (j = 0; j < fdma_rx_old.n_dbs; ++j)
+                       page_pool_put_full_page(page_pool,
+                                               old_pages[i][j], false);
+
        fdma_free_coherent(lan966x->dev, &fdma_rx_old);
 
        page_pool_destroy(page_pool);
@@ -841,12 +851,17 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
        lan966x_fdma_wakeup_netdev(lan966x);
        napi_enable(&lan966x->napi);
 
-       return err;
+       kfree(old_pages);
+       return 0;
 restore:
        lan966x->rx.page_pool = page_pool;
        memcpy(&lan966x->rx.fdma, &fdma_rx_old, sizeof(struct fdma));
        lan966x_fdma_rx_start(&lan966x->rx);
 
+       lan966x_fdma_wakeup_netdev(lan966x);
+       napi_enable(&lan966x->napi);
+
+       kfree(old_pages);
        return err;
 }