提交 4f9de4df 编写于 作者: S Sudarsana Reddy Kalluru 提交者: David S. Miller

qed: Fix possible memory leak in Rx error path handling.

Memory for packet buffers need to be freed in the error paths as there is
no consumer (e.g., upper layer) for such packets and that memory will never
get freed.
The issue was uncovered when port was attacked with flood of isatap
packets, these are multicast packets hence were directed at all the PFs.
For foce PF, this meant they were routed to the ll2 module which in turn
drops such packets.

Fixes: 0a7fb11c ("qed: Add Light L2 support")
Signed-off-by: NSudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: NAriel Elior <ariel.elior@cavium.com>
Signed-off-by: NMichal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 7e85dc8c
...@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data) ...@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
skb = build_skb(buffer->data, 0); skb = build_skb(buffer->data, 0);
if (!skb) { if (!skb) {
rc = -ENOMEM; DP_INFO(cdev, "Failed to build SKB\n");
goto out_post; kfree(buffer->data);
goto out_post1;
} }
data->u.placement_offset += NET_SKB_PAD; data->u.placement_offset += NET_SKB_PAD;
...@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data) ...@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb, cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb,
data->opaque_data_0, data->opaque_data_0,
data->opaque_data_1); data->opaque_data_1);
} else {
DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA |
QED_MSG_LL2 | QED_MSG_STORAGE),
"Dropping the packet\n");
kfree(buffer->data);
} }
out_post1:
/* Update Buffer information and update FW producer */ /* Update Buffer information and update FW producer */
buffer->data = new_data; buffer->data = new_data;
buffer->phys_addr = new_phys_addr; buffer->phys_addr = new_phys_addr;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册