Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932377AbdIRJoU (ORCPT ); Mon, 18 Sep 2017 05:44:20 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:55514 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932151AbdIRJNf (ORCPT ); Mon, 18 Sep 2017 05:13:35 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eran Ben Elisha , Saeed Mahameed Subject: [PATCH 4.12 26/52] net/mlx5e: Fix dangling page pointer on DMA mapping error Date: Mon, 18 Sep 2017 11:11:20 +0200 Message-Id: <20170918091020.500846984@linuxfoundation.org> X-Mailer: git-send-email 2.14.1 In-Reply-To: <20170918091016.620101134@linuxfoundation.org> References: <20170918091016.620101134@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1334 Lines: 40 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eran Ben Elisha [ Upstream commit 0556ce72ab16156af6c94cdc7964e4310acc97c0 ] Function mlx5e_dealloc_rx_wqe is using page pointer value as an indication to valid DMA mapping. In case that the mapping failed, we released the page but kept the dangling pointer. Store the page pointer only after the DMA mapping passed to avoid invalid page DMA unmap. Fixes: bc77b240b3c5 ("net/mlx5e: Add fragmented memory support for RX multi packet WQE") Signed-off-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -216,13 +216,13 @@ static inline int mlx5e_page_alloc_mappe if (unlikely(!page)) return -ENOMEM; - dma_info->page = page; dma_info->addr = dma_map_page(rq->pdev, page, 0, RQ_PAGE_SIZE(rq), rq->buff.map_dir); if (unlikely(dma_mapping_error(rq->pdev, dma_info->addr))) { put_page(page); return -ENOMEM; } + dma_info->page = page; return 0; }