[PATCH net-next v6 1/4] net: stmmac: take ownership of saved RX state at poll entry

[Nicolai Buchwitz]

On 12.10.2026 18:44, Lorenzo Bianconi wrote:
> From: James Hilliard <james.hilliard1 at gmail.com>
> 
> When a saved partial packet completes with a poll budget of one, the
> old loop can leave state_saved and state.skb pointing at an skb that
> has already been delivered or freed. The next poll then reuses that
> pointer, causing a use-after-free or double free.
> 
> Take the saved state at poll entry and clear the stored ownership
> immediately. Save it again only if the packet remains incomplete,
> including when the next descriptor is still DMA-owned.
> 
> Track the frame-in-progress flag independently of the status read from
> the next descriptor. The old code keyed the save on the status of the
> last descriptor looked at, so a loop stopped at a DMA-owned descriptor
> (rx status not yet valid) could drop the saved error/length bookkeeping
> in stmmac_rx_zc().
> 
> Drop the saved state both when the queue parameters are reset and when
> the ring is destroyed. stmmac_reset_rx_queue() is reached from
> __stmmac_open(), stmmac_xdp_open(), stmmac_resume() and
> stmmac_enable_rx_queue(); without draining it there, a partial frame
> saved before suspend (or before a queue is disabled and re-enabled)
> survives while cur_rx and dirty_rx are re-armed, and the first poll
> resumes that stale skb with descriptors from the freshly initialized
> ring. __free_dma_rx_desc_resources() releases it on teardown.
> 
> Apply the same state handling to stmmac_rx_zc(), which also leaves
> state_saved set when a saved frame finishes at the budget boundary.
> That path saves only error and length bookkeeping, not an skb pointer.
> 
> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header 
> support")
> Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
> Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at oss.qualcomm.com>
> ---

> [...]

Reviewed-by: Nicolai Buchwitz <nb at tipi-net.de>

Thanks,
Nicolai