Re: [PATCH net v5] qede: Fix NULL pointer dereference in TPA fragment processing

From
patchwork-bot+netdevbpf@kernel.org
Date
2026-08-22 20:31:13
Also in
lkml, stable
Reply to
Vaibhav Nagare, 2026-08-18
Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Tue, 18 Aug 2026 13:03:09 +0530 you wrote:
Under memory pressure, the qede driver encounters NULL pointer
dereferences when processing TPA continuation fragments.

Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally
dropped the assignment of tpa_info->buffer.data in qede_tpa_start().

When memory pressure causes an SKB allocation failure in qede_tpa_start(),
the driver sets tpa_start_fail = true and attempts to recycle the physical
page later in qede_tpa_end() via qede_reuse_page(). However, because
buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a
"ghost" BD (valid DMA mapping but NULL data pointer) back into the
active Rx ring.

[...]
Here is the summary with links:
  - [net,v5] qede: Fix NULL pointer dereference in TPA fragment processing
    https://git.kernel.org/netdev/net/c/06aa3d26327f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Thread (2 messages) 2 messages, 2 authors, last reply 2026-08-22
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help