Re: [PATCH net] qede: fix off-by-one in BD ring consumption on build_skb failure

[Jamie Bainbridge]

On Wed, 1 Jul 2026 at 02:47, Shigeru Yoshida <syoshida@xxxxxxxxxx> wrote:
>
> qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
> NULL return from qede_build_skb(). When it returns NULL under memory
> pressure, the functions still consume a BD from the ring before
> returning NULL. The callers then recycle additional BDs, resulting in
> one extra BD being consumed (off-by-one). This desynchronizes the BD
> ring, which can corrupt DMA page reference counts and lead to SLUB
> freelist corruption.

Good catch.

Reviewed-by: Jamie Bainbridge <jamie.bainbridge@xxxxxxxxx>

> Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
> added a NULL check inside qede_build_skb() to prevent a NULL pointer
> dereference, but did not address the missing NULL checks in the
> callers, making this off-by-one reachable.
>
> Fix this by adding NULL checks for the return value of
> qede_build_skb() in both qede_rx_build_skb() and
> qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
> manipulation.
>
> Fixes: 4e910dbe3650 ("qede: confirm skb is allocated before using")
> Signed-off-by: Shigeru Yoshida <syoshida@xxxxxxxxxx>
> ---
>  drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
> index 33e18bb69774..c11e0d8f98aa 100644
> --- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
> +++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
> @@ -765,6 +765,9 @@ qede_tpa_rx_build_skb(struct qede_dev *edev,
>         struct sk_buff *skb;
>
>         skb = qede_build_skb(rxq, bd, len, pad);
> +       if (unlikely(!skb))
> +               return NULL;
> +
>         bd->page_offset += rxq->rx_buf_seg_size;
>
>         if (bd->page_offset == PAGE_SIZE) {
> @@ -812,6 +815,8 @@ qede_rx_build_skb(struct qede_dev *edev,
>         }
>
>         skb = qede_build_skb(rxq, bd, len, pad);
> +       if (unlikely(!skb))
> +               return NULL;
>
>         if (unlikely(qede_realloc_rx_buffer(rxq, bd))) {
>                 /* Incr page ref count to reuse on allocation failure so
> --
> 2.54.0
>