[PATCH net v2 0/2] eth: fbnic: validate the Rx completion path

[Yehyeong Lee]

Patch 1 is v2 of "eth: fbnic: validate the Rx completion buffer index".
Besides bounding the completion buffer index against rx_buf[], it now
also rejects a buffer-descriptor-queue clean-up head that falls outside
the ring in fbnic_clean_bdq(), and sets add_frag_failed when
fbnic_add_rx_frag() bails on a buffer that was never set up.  Both were
raised in review of v1:
https://lore.kernel.org/netdev/20261009175358.1598001-1-yhlee@xxxxxxxxxxxxxxxxxx/

Patch 2 returns a page-pool reference that is leaked on the
fragment-overflow path of the same function, found while auditing
patch 1.  It carries a different Fixes tag, so it is a separate patch.

v2:
 - patch 1: also reject an out-of-range clean-up head in
   fbnic_clean_bdq(), and set add_frag_failed in fbnic_add_rx_frag()'s
   no-buffer bail.
 - patch 2: new.

Yehyeong Lee (2):
  eth: fbnic: validate the Rx completion buffer index
  eth: fbnic: return the page reference taken for a dropped Rx fragment

 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 40 +++++++++++++++++++-
 1 file changed, 38 insertions(+), 2 deletions(-)

-- 
2.43.0