From 38ed7e44028c87bf1310e6575be0e564216a6e85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=8E=8B=E8=B6=8A?= <1939455790@qq.com> Date: Sat, 11 Jul 2026 12:50:58 +0000 Subject: [PATCH] =?UTF-8?q?net/mlx5e:=20kTLS:=20=E8=A1=A5=E5=85=85=20tx=20?= =?UTF-8?q?=E9=A1=B5=E9=9D=A2=E5=BC=95=E7=94=A8=E8=AE=A1=E6=95=B0=E4=B8=80?= =?UTF-8?q?=E8=87=B4=E6=80=A7=E6=B3=A8=E9=87=8A=EF=BC=8C=E9=98=B2=E6=AD=A2?= =?UTF-8?q?=20CVE-2024-53138=20=E5=9B=9E=E5=BD=92?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2024-53138（net/mlx5e: kTLS, Fix incorrect page refcounting）的修复 已作为回溯补丁 e5ec97a60309（上游 commit dd6e972cc5890d91d6749bb48e3912721c4e4b25）合入本分支 linux-6.6-next （当前内核版本为 6.6.129，高于不受影响阈值 6.6.55）。经核实， drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c 中 tx_sync_info_get()、mlx5e_ktls_tx_handle_resync_dump_comp() 与 mlx5e_ktls_tx_handle_ooo() 错误路径均已统一使用 page_ref_* 系列 API， en_accel 目录下不再残留 get_page()/put_page() 调用，漏洞处于已修复状态。 为防止后续维护者将该处 page_ref_inc() 误改回 get_page() 而重新引入漏洞， 参照同一错误释放路径（err_out）既有的注释风格，在 tx_sync_info_get() 获取页面引用处补充注释：说明必须将引用计数记在给定 page 自身（而非 folio 头页）上，以与 DUMP WQE 及其完成路径的 page_ref_add()/page_ref_dec() 保持一致，满足大 folio（large folios）场景下的正确性。 本次变更仅新增注释，不改变任何运行时行为。 Signed-off-by: 王越 <1939455790@qq.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c index 3db31cc10719..737f4ad87165 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c @@ -660,6 +660,10 @@ tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx, while (remaining > 0) { skb_frag_t *frag = &record->frags[i]; + /* Keep the ref on this page itself rather than the folio head + * (get_page) to match the page_ref_add()/page_ref_dec() used by + * the DUMP WQE and its completion path; required for large folios. + */ page_ref_inc(skb_frag_page(frag)); remaining -= skb_frag_size(frag); info->frags[i++] = *frag; -- Gitee