[PATCH net] net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

patchwork-bot+netdevbpf at kernel.org patchwork-bot+netdevbpf at kernel.org
Mon Apr 27 17:50:15 PDT 2026


Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba at kernel.org>:

On Fri, 24 Apr 2026 11:00:28 +0200 you wrote:
> The transmit loop in airoha_dev_xmit() reads fragment address and length
> during its final iteration, when the loop index equals
> skb_shinfo(skb)->nr_frags, at which point the fragment data is
> uninitialized. While these values are never consumed, the read itself is
> unsafe and may trigger a page fault. Fix this by avoiding the fragment
> read on the last iteration.
> Additionally, move the skb pointer from the first to the last used packet
> descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb
> until the final descriptor is processed.
> 
> [...]

Here is the summary with links:
  - [net] net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
    https://git.kernel.org/netdev/net/c/bde34e84edc8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html





More information about the Linux-mediatek mailing list