Thread (6 messages) 6 messages, 4 authors, 2d ago

Re: [PATCH net] qede: fix off-by-one in BD ring consumption on build_skb failure

From: patchwork-bot+netdevbpf@kernel.org
Date: 2026-07-06 10:10:24
Also in: lkml

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni [off-list ref]:

On Wed,  1 Jul 2026 01:46:20 +0900 you wrote:
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.

[...]
Here is the summary with links:
  - [net] qede: fix off-by-one in BD ring consumption on build_skb failure
    https://git.kernel.org/netdev/net/c/a0a558ca7e75

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help