net/mlx5e: Fix use-after-free after xdp_return_frame
authorMaxim Mikityanskiy <maximmi@mellanox.com>
Fri, 15 Mar 2019 14:41:43 +0000 (16:41 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 2 May 2019 07:59:01 +0000 (09:59 +0200)
commit041b3224e8f848b2024cae470ea49c46db92ffd3
treeccce2afa0584ec65853c2b7334c03f55609401d8
parentae6b07107458435fd9f782c800f859534e9bc097
net/mlx5e: Fix use-after-free after xdp_return_frame

[ Upstream commit 12fc512f5741443a03adde2ead20724da8ad550a ]

xdp_return_frame releases the frame. It leads to releasing the page, so
it's not allowed to access xdpi.xdpf->len after that, because xdpi.xdpf
is at xdp->data_hard_start after convert_to_xdp_frame. This patch moves
the memory access to precede the return of the frame.

Fixes: 58b99ee3e3ebe ("net/mlx5e: Add support for XDP_REDIRECT in device-out side")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c