Re: [PATCH net] qede: fix off-by-one in BD ring consumption on build_skb failure

[Paolo Abeni]

On 7/5/26 5:53 PM, Shigeru Yoshida wrote:
> Jamie Bainbridge <jamie.bainbridge@xxxxxxxxx> writes:
> 
>> On Fri, 3 Jul 2026 at 09:52, Jamie Bainbridge
>> <jamie.bainbridge@xxxxxxxxx> wrote:
>>>
>>> On Wed, 1 Jul 2026 at 02:47, Shigeru Yoshida <syoshida@xxxxxxxxxx> wrote:
>>>>
>>>> qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
>>>> NULL return from qede_build_skb(). When it returns NULL under memory
>>>> pressure, the functions still consume a BD from the ring before
>>>> returning NULL. The callers then recycle additional BDs, resulting in
>>>> one extra BD being consumed (off-by-one). This desynchronizes the BD
>>>> ring, which can corrupt DMA page reference counts and lead to SLUB
>>>> freelist corruption.
>>>
>>> Good catch.
>>>
>>> Reviewed-by: Jamie Bainbridge <jamie.bainbridge@xxxxxxxxx>
>>
>> Sorry for the double mail.
>>
>> I believe the Fixes: should be against the problematic original code:
>>
>> Fixes: 8a8633978b842 ("qede: Add build_skb() support.")
>>
>> because that is what you are fixing.
> 
> Thank you for your review.
> 
> The problematic code was introduced in commit 8a8633978b84 ("qede: Add
> build_skb() support."), so putting this in the Fixes tag would be
> correct.
> 
> I'll send the v2 patch with the modified Fixes tag.

No need for a v2: I'll update the fixes tag while applying the patch.
The PW is already quite significant and I think it's currently better to
avoid repost if possible.

Thanks!

Paolo