* [PATCH 4/4] net: hns3: double free 'skb'
@ 2021-02-03 3:13 Wenjia Zhao
2021-02-03 3:51 ` Yunsheng Lin
0 siblings, 1 reply; 2+ messages in thread
From: Wenjia Zhao @ 2021-02-03 3:13 UTC (permalink / raw)
Cc: driverfuzzing, Yisen Zhuang, Salil Mehta, David S. Miller,
Jakub Kicinski, netdev, linux-kernel
net: hns3: double free 'skb'
The false branch of (tx_ret == NETDEV_TX_OK) free the skb. However, the
kfree_skb(skb) in the out label will be execute when exits the function.
So the skb has a double-free bugs.
Remove the kfree_skb(skb) at line 269
Signed-off-by: Wenjia Zhao <driverfuzzing@gmail.com>
---
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 2622e04..1b926ff 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -266,7 +266,6 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)
if (tx_ret == NETDEV_TX_OK) {
good_cnt++;
} else {
- kfree_skb(skb);
netdev_err(ndev, "hns3_lb_run_test xmit failed: %d\n",
tx_ret);
}
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 4/4] net: hns3: double free 'skb'
2021-02-03 3:13 [PATCH 4/4] net: hns3: double free 'skb' Wenjia Zhao
@ 2021-02-03 3:51 ` Yunsheng Lin
0 siblings, 0 replies; 2+ messages in thread
From: Yunsheng Lin @ 2021-02-03 3:51 UTC (permalink / raw)
To: Wenjia Zhao
Cc: Yisen Zhuang, Salil Mehta, David S. Miller, Jakub Kicinski,
netdev, linux-kernel
On 2021/2/3 11:13, Wenjia Zhao wrote:
> net: hns3: double free 'skb'
>
> The false branch of (tx_ret == NETDEV_TX_OK) free the skb. However, the
> kfree_skb(skb) in the out label will be execute when exits the function.
> So the skb has a double-free bugs.
>
> Remove the kfree_skb(skb) at line 269
The freeing is added by the below patch:
commit: 8f9eed1a8791("net: hns3: fix for skb leak when doing selftest")
which is to fix a skb leak problem.
kfree_skb(skb) in the out label corresponds to alloc_skb(),
and kfree_skb(skb) removed in this patch corresponds to
skb_get(skb) before calling hns3_nic_net_xmit() when
hns3_nic_net_xmit() non-NETDEV_TX_OK.
So I do not think there is double free 'skb' here, unless
I miss something here?
>
> Signed-off-by: Wenjia Zhao <driverfuzzing@gmail.com>
> ---
> drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
> index 2622e04..1b926ff 100644
> --- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
> +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
> @@ -266,7 +266,6 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)
> if (tx_ret == NETDEV_TX_OK) {
> good_cnt++;
> } else {
> - kfree_skb(skb);
> netdev_err(ndev, "hns3_lb_run_test xmit failed: %d\n",
> tx_ret);
> }
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-02-03 3:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-03 3:13 [PATCH 4/4] net: hns3: double free 'skb' Wenjia Zhao
2021-02-03 3:51 ` Yunsheng Lin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.