net/mlx5e: Destroy page pool after XDP SQ to fix use-after-free
authorMaxim Mikityanskiy <maximmi@nvidia.com>
Mon, 24 May 2021 13:15:22 +0000 (16:15 +0300)
committerSaeed Mahameed <saeedm@nvidia.com>
Tue, 10 Aug 2021 03:56:43 +0000 (20:56 -0700)
commit8ba3e4c85825c8801a2c298dcadac650a40d7137
tree1c4aca309e98b998c4adff1a4daba5f26c3c2d09
parent6d8680da2e98410a25fe49e0a53f28c004be6d6d
net/mlx5e: Destroy page pool after XDP SQ to fix use-after-free

mlx5e_close_xdpsq does the cleanup: it calls mlx5e_free_xdpsq_descs to
free the outstanding descriptors, which relies on
mlx5e_page_release_dynamic and page_pool_release_page. However,
page_pool_destroy is already called by this point, because
mlx5e_close_rq runs before mlx5e_close_xdpsq.

This commit fixes the use-after-free by swapping mlx5e_close_xdpsq and
mlx5e_close_rq.

The commit cited below started calling page_pool_destroy directly from
the driver. Previously, the page pool was destroyed under a call_rcu
from xdp_rxq_info_unreg_mem_model, which would defer the deallocation
until after the XDPSQ is cleaned up.

Fixes: 1da4bbeffe41 ("net: core: page_pool: add user refcnt and reintroduce page_pool_destroy")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
drivers/net/ethernet/mellanox/mlx5/core/en_main.c