You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
87 lines
3.1 KiB
87 lines
3.1 KiB
From d3f75b38e63b7dc82b0c8befc18dd84665171f8e Mon Sep 17 00:00:00 2001
|
|
From: Igor Russkikh <irusskik@redhat.com>
|
|
Date: Fri, 6 Nov 2020 18:37:18 -0500
|
|
Subject: [PATCH 061/139] [netdrv] net: atlantic: fix use after free kasan warn
|
|
|
|
Message-id: <1604687916-15087-62-git-send-email-irusskik@redhat.com>
|
|
Patchwork-id: 338490
|
|
Patchwork-instance: patchwork
|
|
O-Subject: [RHEL8.4 BZ 1857861 061/139] net: atlantic: fix use after free kasan warn
|
|
Bugzilla: 1857861
|
|
RH-Acked-by: David Arcari <darcari@redhat.com>
|
|
RH-Acked-by: John Linville <linville@redhat.com>
|
|
RH-Acked-by: Tony Camuso <tcamuso@redhat.com>
|
|
|
|
Bugzilla: http://bugzilla.redhat.com/1857861
|
|
|
|
commit a4980919ad6a7be548d499bc5338015e1a9191c6
|
|
Author: Pavel Belous <pbelous@marvell.com>
|
|
Date: Fri Feb 14 18:44:55 2020 +0300
|
|
|
|
net: atlantic: fix use after free kasan warn
|
|
|
|
skb->len is used to calculate statistics after xmit invocation.
|
|
|
|
Under a stress load it may happen that skb will be xmited,
|
|
rx interrupt will come and skb will be freed, all before xmit function
|
|
is even returned.
|
|
|
|
Eventually, skb->len will access unallocated area.
|
|
|
|
Moving stats calculation into tx_clean routine.
|
|
|
|
Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code")
|
|
Reported-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm>
|
|
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
|
|
Signed-off-by: Pavel Belous <pbelous@marvell.com>
|
|
Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
|
Signed-off-by: Igor Russkikh <irusskik@redhat.com>
|
|
|
|
Cc: David Arcari <darcari@redhat.com>
|
|
Cc: Igor Russkikh <irusskik@redhat.com>
|
|
Signed-off-by: Jan Stancek <jstancek@redhat.com>
|
|
---
|
|
drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 ----
|
|
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 7 +++++--
|
|
2 files changed, 5 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
|
|
index c85e3e29012c..263beea1859c 100644
|
|
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
|
|
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
|
|
@@ -655,10 +655,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
|
|
if (likely(frags)) {
|
|
err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw,
|
|
ring, frags);
|
|
- if (err >= 0) {
|
|
- ++ring->stats.tx.packets;
|
|
- ring->stats.tx.bytes += skb->len;
|
|
- }
|
|
} else {
|
|
err = NETDEV_TX_BUSY;
|
|
}
|
|
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
|
|
index 6941999ae845..bae95a618560 100644
|
|
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
|
|
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
|
|
@@ -272,9 +272,12 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
|
|
}
|
|
}
|
|
|
|
- if (unlikely(buff->is_eop))
|
|
- dev_kfree_skb_any(buff->skb);
|
|
+ if (unlikely(buff->is_eop)) {
|
|
+ ++self->stats.rx.packets;
|
|
+ self->stats.tx.bytes += buff->skb->len;
|
|
|
|
+ dev_kfree_skb_any(buff->skb);
|
|
+ }
|
|
buff->pa = 0U;
|
|
buff->eop_index = 0xffffU;
|
|
self->sw_head = aq_ring_next_dx(self, self->sw_head);
|
|
--
|
|
2.13.6
|
|
|