From e1541b0cdf147beef46101f2b9fa8aeb9793bd8d Mon Sep 17 00:00:00 2001 From: Haiyang Zhang Date: Fri, 21 Apr 2023 10:06:58 -0700 Subject: [PATCH 21/23] net: mana: Check if netdev/napi_alloc_frag returns single page netdev/napi_alloc_frag() may fall back to single page which is smaller than the requested size. Add error checking to avoid memory overwritten. Signed-off-by: Haiyang Zhang Signed-off-by: Jakub Kicinski (cherry picked from commit df18f2da302f169e1a29098c6ca3b474f1b0269e) Signed-off-by: Bastian Blank --- drivers/net/ethernet/microsoft/mana/mana_en.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 34fa5c758b28..fc19e62c9c84 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -553,6 +553,14 @@ static int mana_pre_alloc_rxbufs(struct mana_port_context *mpc, int new_mtu) va = netdev_alloc_frag(mpc->rxbpre_alloc_size); if (!va) goto error; + + page = virt_to_head_page(va); + /* Check if the frag falls back to single page */ + if (compound_order(page) < + get_order(mpc->rxbpre_alloc_size)) { + put_page(page); + goto error; + } } else { page = dev_alloc_page(); if (!page) @@ -1505,6 +1513,13 @@ static void *mana_get_rxfrag(struct mana_rxq *rxq, struct device *dev, if (!va) return NULL; + + page = virt_to_head_page(va); + /* Check if the frag falls back to single page */ + if (compound_order(page) < get_order(rxq->alloc_size)) { + put_page(page); + return NULL; + } } else { page = dev_alloc_page(); if (!page) -- 2.40.1