From: maowenan <maowenan@huawei.com>
To: Eric Dumazet <eric.dumazet@gmail.com>,
<tsbogend@alpha.franken.de>, <davem@davemloft.net>
Cc: <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY
Date: Thu, 5 Sep 2019 08:56:34 +0800 [thread overview]
Message-ID: <960c7d1f-6e80-84fb-8d7a-9c5692605500@huawei.com> (raw)
In-Reply-To: <c4a4d1b0-d036-7af7-2b30-117f9fdee9ad@gmail.com>
On 2019/9/4 18:19, Eric Dumazet wrote:
>
>
> On 9/4/19 11:42 AM, Mao Wenan wrote:
>> When dma_map_single is failed to map buffer, skb can't be freed
>> before sonic driver return to stack with NETDEV_TX_BUSY, because
>> this skb may be requeued to qdisc, it might trigger use-after-free.
>>
>> Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
>> Signed-off-by: Mao Wenan <maowenan@huawei.com>
>> ---
>> drivers/net/ethernet/natsemi/sonic.c | 1 -
>> 1 file changed, 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
>> index d0a01e8f000a..248a8f22a33b 100644
>> --- a/drivers/net/ethernet/natsemi/sonic.c
>> +++ b/drivers/net/ethernet/natsemi/sonic.c
>> @@ -233,7 +233,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
>> laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
>> if (!laddr) {
>> printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
>> - dev_kfree_skb(skb);
>> return NETDEV_TX_BUSY;
>> }
>>
>>
>
> That is the wrong way to fix this bug.
>
> What guarantee do we have that the mapping operation will succeed next time we attempt
> the transmit (and the dma_map_single() operation) ?
>
> NETDEV_TX_BUSY is very dangerous, this might trigger an infinite loop.
>
> I would rather leave the dev_kfree_skb(skb), and return NETDEV_TX_OK
yes, right, it will go to infinite loop if dma_map_single failed always.
v2 will be sent later.
>
> Also the printk(KERN_ERR ...) should be replaced by pr_err_ratelimited(...)
>
> NETDEV_TX_BUSY really should only be used by drivers that call netif_tx_stop_queue()
> at the wrong moment.
It will call netif_tx_stop_queue() then return NETDEV_TX_BUSY, and give a chance to
netif_tx_wake_queue(), then stack can be resent packet to driver?
>
> .
>
next prev parent reply other threads:[~2019-09-05 0:56 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-04 9:42 Mao Wenan
2019-09-04 9:50 ` Thomas Bogendoerfer
2019-09-04 10:19 ` Eric Dumazet
2019-09-05 0:56 ` maowenan [this message]
2019-09-05 1:57 ` [PATCH v2 net] net: sonic: return NETDEV_TX_OK if failed to map buffer Mao Wenan
2019-09-06 13:05 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=960c7d1f-6e80-84fb-8d7a-9c5692605500@huawei.com \
--to=maowenan@huawei.com \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=tsbogend@alpha.franken.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®