Jamie Bainbridge [off-list ref] writes:

On Fri, 3 Jul 2026 at 09:52, Jamie Bainbridge
[off-list ref] wrote:

quoted

On Wed, 1 Jul 2026 at 02:47, Shigeru Yoshida [off-list ref] wrote:

quoted

qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.

Good catch.

Reviewed-by: Jamie Bainbridge <redacted>

Sorry for the double mail.

I believe the Fixes: should be against the problematic original code:

Fixes: 8a8633978b842 ("qede: Add build_skb() support.")

because that is what you are fixing.

Thank you for your review.

The problematic code was introduced in commit 8a8633978b84 ("qede: Add
build_skb() support."), so putting this in the Fixes tag would be
correct.

I'll send the v2 patch with the modified Fixes tag.

Thank you,
Shigeru

Jamie

quoted

quoted

Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.

Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.

Fixes: 4e910dbe3650 ("qede: confirm skb is allocated before using")
Signed-off-by: Shigeru Yoshida <redacted>
---
 drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index 33e18bb69774..c11e0d8f98aa 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c

@@ -765,6 +765,9 @@ qede_tpa_rx_build_skb(struct qede_dev *edev,
        struct sk_buff *skb;

        skb = qede_build_skb(rxq, bd, len, pad);
+       if (unlikely(!skb))
+               return NULL;
+
        bd->page_offset += rxq->rx_buf_seg_size;

        if (bd->page_offset == PAGE_SIZE) {

@@ -812,6 +815,8 @@ qede_rx_build_skb(struct qede_dev *edev,
        }

        skb = qede_build_skb(rxq, bd, len, pad);
+       if (unlikely(!skb))
+               return NULL;

        if (unlikely(qede_realloc_rx_buffer(rxq, bd))) {
                /* Incr page ref count to reuse on allocation failure so
--

2.54.0