Re: [PATCH v2] net/mlx4_en: fix potential use-after-free with dma_unmap_page

On 28/04/2018 2:48 AM, David Miller wrote:

From: Sarah Newman <redacted>
Date: Wed, 25 Apr 2018 21:00:34 -0700

quoted

When swiotlb is in use, calling dma_unmap_page means that
the original page mapped with dma_map_page must still be valid
as swiotlb will copy data from its internal cache back to the
originally requested DMA location. When GRO is enabled,
all references to the original frag may be put before
mlx4_en_free_frag is called, meaning the page has been freed
before the call to dma_unmap_page in mlx4_en_free_frag.

To fix, unmap the page as soon as possible.

This can be trivially detected by doing the following:

Compile the kernel with DEBUG_PAGEALLOC
Run the kernel as a Xen Dom0
Leave GRO enabled on the interface
Run a 10 second or more test with iperf over the interface.

Signed-off-by: Sarah Newman <redacted>

Tariq, I assume I will get this from you in the next set of
changes you submit to me.

Thanks.

This patch fixes an issue existing in old kernels. It is not relevant per latest code.

So I'm not sure about the process. After I review it, do I just submit it again for -stable?

Thanks.