net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

When lan966x_fdma_reload() fails to allocate new RX buffers, the restore
path restarts DMA using old descriptors whose pages were already freed
via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can
release pages back to the buddy allocator, the hardware may DMA into
memory now owned by other kernel subsystems.

Additionally, on the restore path, the newly created page pool (if
allocation partially succeeded) is overwritten without being destroyed,
leaking it.

Fix both issues by deferring the release of old pages until after the
new allocation succeeds. Save the old page array before the allocation
so old pages can be freed on the success path. On the failure path, the
old descriptors, pages and page pool are all still valid, making the
restore safe. Also ensure the restore path re-enables NAPI and wakes
the netdev, matching the success path.

Fixes: 89ba464fcf54 ("net: lan966x: refactor buffer reload function")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260405055241.35767-4-devnexen@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
index 10773fe93d4d71cb97ed69bc1c06658e264d2019..f8ce735a7fc090f6c3e2527124cc9d8657a579dd 100644 (file)
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c
@@ -812,9 +812,15 @@ static int lan966x_qsys_sw_status(struct lan966x *lan966x)
 
 static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
 {
+       struct page *(*old_pages)[FDMA_RX_DCB_MAX_DBS];
        struct page_pool *page_pool;
        struct fdma fdma_rx_old;
-       int err;
+       int err, i, j;
+
+       old_pages = kmemdup(lan966x->rx.page, sizeof(lan966x->rx.page),
+                          GFP_KERNEL);
+       if (!old_pages)
+               return -ENOMEM;
 
        /* Store these for later to free them */
        memcpy(&fdma_rx_old, &lan966x->rx.fdma, sizeof(struct fdma));
@@ -825,7 +831,6 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
        lan966x_fdma_stop_netdev(lan966x);
 
        lan966x_fdma_rx_disable(&lan966x->rx);
-       lan966x_fdma_rx_free_pages(&lan966x->rx);
        lan966x->rx.page_order = round_up(new_mtu, PAGE_SIZE) / PAGE_SIZE - 1;
        lan966x->rx.max_mtu = new_mtu;
        err = lan966x_fdma_rx_alloc(&lan966x->rx);
@@ -833,6 +838,11 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
                goto restore;
        lan966x_fdma_rx_start(&lan966x->rx);
 
+       for (i = 0; i < fdma_rx_old.n_dcbs; ++i)
+               for (j = 0; j < fdma_rx_old.n_dbs; ++j)
+                       page_pool_put_full_page(page_pool,
+                                               old_pages[i][j], false);
+
        fdma_free_coherent(lan966x->dev, &fdma_rx_old);
 
        page_pool_destroy(page_pool);
@@ -840,12 +850,17 @@ static int lan966x_fdma_reload(struct lan966x *lan966x, int new_mtu)
        lan966x_fdma_wakeup_netdev(lan966x);
        napi_enable(&lan966x->napi);
 
-       return err;
+       kfree(old_pages);
+       return 0;
 restore:
        lan966x->rx.page_pool = page_pool;
        memcpy(&lan966x->rx.fdma, &fdma_rx_old, sizeof(struct fdma));
        lan966x_fdma_rx_start(&lan966x->rx);
 
+       lan966x_fdma_wakeup_netdev(lan966x);
+       napi_enable(&lan966x->napi);
+
+       kfree(old_pages);
        return err;
 }