On 7/5/26 5:53 PM, Shigeru Yoshida wrote:

Jamie Bainbridge [off-list ref] writes:

quoted

On Fri, 3 Jul 2026 at 09:52, Jamie Bainbridge
[off-list ref] wrote:

quoted

On Wed, 1 Jul 2026 at 02:47, Shigeru Yoshida [off-list ref] wrote:

quoted

qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.

Good catch.

Reviewed-by: Jamie Bainbridge <redacted>

Sorry for the double mail.

I believe the Fixes: should be against the problematic original code:

Fixes: 8a8633978b842 ("qede: Add build_skb() support.")

because that is what you are fixing.

Thank you for your review.

The problematic code was introduced in commit 8a8633978b84 ("qede: Add
build_skb() support."), so putting this in the Fixes tag would be
correct.

I'll send the v2 patch with the modified Fixes tag.

No need for a v2: I'll update the fixes tag while applying the patch.
The PW is already quite significant and I think it's currently better to
avoid repost if possible.

Thanks!

Paolo