Skip to content

Commit

Permalink
qed: Fix possible memory leak in Rx error path handling.
Browse files Browse the repository at this point in the history
Memory for packet buffers need to be freed in the error paths as there is
no consumer (e.g., upper layer) for such packets and that memory will never
get freed.
The issue was uncovered when port was attacked with flood of isatap
packets, these are multicast packets hence were directed at all the PFs.
For foce PF, this meant they were routed to the ll2 module which in turn
drops such packets.

Fixes: 0a7fb11 ("qed: Add Light L2 support")
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Sudarsana Reddy Kalluru authored and davem330 committed Jun 19, 2018
1 parent 7e85dc8 commit 4f9de4d
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions drivers/net/ethernet/qlogic/qed/qed_ll2.c
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)

skb = build_skb(buffer->data, 0);
if (!skb) {
rc = -ENOMEM;
goto out_post;
DP_INFO(cdev, "Failed to build SKB\n");
kfree(buffer->data);
goto out_post1;
}

data->u.placement_offset += NET_SKB_PAD;
Expand All @@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb,
data->opaque_data_0,
data->opaque_data_1);
} else {
DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA |
QED_MSG_LL2 | QED_MSG_STORAGE),
"Dropping the packet\n");
kfree(buffer->data);
}

out_post1:
/* Update Buffer information and update FW producer */
buffer->data = new_data;
buffer->phys_addr = new_phys_addr;
Expand Down

0 comments on commit 4f9de4d

Please sign in to comment.