All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jakub Kicinski <kuba@kernel.org>
To: Julian Wiedmann <jwi@linux.ibm.com>
Cc: "Vincent Stehlé" <vincent.stehle@laposte.net>,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	"David S . Miller" <davem@davemloft.net>,
	"Florian Fainelli" <florian.fainelli@telecomint.eu>
Subject: Re: [PATCH] net: korina: remove busy skb free
Date: Mon, 14 Dec 2020 13:08:32 -0800	[thread overview]
Message-ID: <20201214130832.7bedb230@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com> (raw)
In-Reply-To: <ecd7900f-8b54-23e2-2537-033237e08597@linux.ibm.com>

On Mon, 14 Dec 2020 11:03:12 +0100 Julian Wiedmann wrote:
> > diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
> > index bf48f0ded9c7d..9d84191de6824 100644
> > --- a/drivers/net/ethernet/korina.c
> > +++ b/drivers/net/ethernet/korina.c
> > @@ -216,7 +216,6 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
> >  			netif_stop_queue(dev);
> >  		else {
> >  			dev->stats.tx_dropped++;
> > -			dev_kfree_skb_any(skb);
> >  			spin_unlock_irqrestore(&lp->lock, flags);
> >  
> >  			return NETDEV_TX_BUSY;
> >   
> 
> As this skb is returned to the stack (and not dropped), the tx_dropped
> statistics increment looks bogus too.

Since this is clearly an ugly use after free, and nobody complained we
can assume that the driver correctly stops its TX queue ahead of time.
So perhaps we can change the return value to NETDEV_TX_OK instead.

  reply	other threads:[~2020-12-14 21:09 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-13 17:20 [PATCH] net: korina: remove busy skb free Vincent Stehlé
2020-12-14 10:03 ` Julian Wiedmann
2020-12-14 21:08   ` Jakub Kicinski [this message]
2020-12-14 21:27     ` Vincent Stehlé
2020-12-14 22:09     ` [PATCH v2] net: korina: fix return value Vincent Stehlé
2020-12-16 20:43       ` Jakub Kicinski
2020-12-16 21:32         ` Florian Fainelli
2020-12-16 23:02           ` Jakub Kicinski
2020-12-14 21:14   ` [PATCH] net: korina: remove busy skb free Vincent Stehlé

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201214130832.7bedb230@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com \
    --to=kuba@kernel.org \
    --cc=davem@davemloft.net \
    --cc=florian.fainelli@telecomint.eu \
    --cc=jwi@linux.ibm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=vincent.stehle@laposte.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.