Currently STMMAC_DOWN flag is only set/cleared by stmmac_reset_subtask(), to notify driver to stop processing of TX/RX frames. One of these processing paths is for XDP, but it is only ever checked in stmmac_xdp_xmit(), which leaves all other XDP paths vulnerable to processing data while interface is restarting. Make verification of STMMAC_DOWN flag consistent by applying check to all XDP paths. Fixes: 8b278a5b69a22 ("net: stmmac: Add support for XDP_REDIRECT action") Co-developed-by: Chang-Sub Lee Signed-off-by: Chang-Sub Lee Signed-off-by: Jakub Raczynski --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 2a0d7eff88d3..b9ffff001baf 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -5260,12 +5260,18 @@ static int stmmac_xdp_xmit_back(struct stmmac_priv *priv, struct xdp_buff *xdp) { bool zc = !!(xdp->rxq->mem.type == MEM_TYPE_XSK_BUFF_POOL); - struct xdp_frame *xdpf = xdp_convert_buff_to_frame(xdp); + struct xdp_frame *xdpf; int cpu = smp_processor_id(); struct netdev_queue *nq; int queue; int res; + if (unlikely(test_bit(STMMAC_DOWN, &priv->state))) { + xsk_buff_free(xdp); + return STMMAC_XSK_CONSUMED; + } + + xdpf = xdp_convert_buff_to_frame(xdp); if (unlikely(!xdpf)) return STMMAC_XDP_CONSUMED; @@ -5310,7 +5316,9 @@ static int __stmmac_xdp_run_prog(struct stmmac_priv *priv, res = stmmac_xdp_xmit_back(priv, xdp); break; case XDP_REDIRECT: - if (xdp_do_redirect(priv->dev, xdp, prog) < 0) + if (unlikely(test_bit(STMMAC_DOWN, &priv->state))) + res = STMMAC_XDP_CONSUMED; + else if (xdp_do_redirect(priv->dev, xdp, prog) < 0) res = STMMAC_XDP_CONSUMED; else res = STMMAC_XDP_REDIRECT; -- 2.34.1