CVE-2026-98911: dpaa2-switch: fix the error path in dpaa2_switch_rx()
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: fix the error path in dpaa2switchrx()
In case of an error in dpaa2switchrx(), the dpaa2switchfreefd() function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd() is intended to be used on Tx frame descriptors, meaning that it expects in the software annotation area of the FD data to find a valid skb pointer on which to call devkfreeskb().
Fix this by extracting the dmaunmappage() from dpaa2switchbuildlinearskb() directly into the dpaa2switchrx() function. This allows us to directly use freepages() in case of an error before an SKB was created and kfreeskb() afterwards.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Fix dpaa2_switch_rx() error handling by extracting dma_unmap_page() from dpaa2_switch_build_linear_skb() directly into dpaa2_switch_rx(); do not use dpaa2_switch_free_fd() for this error path, because it expects a valid skb pointer in the FD software annotation area. Use free_pages() before an SKB is created and kfree_skb() afterward.