* [PATCH] aoe: avoid using skb member after dev_queue_xmit
@ 2012-10-24 18:26 Ed Cashin, Ed Cashin
2012-10-24 22:08 ` Andrew Morton
0 siblings, 1 reply; 4+ messages in thread
From: Ed Cashin, Ed Cashin @ 2012-10-24 18:26 UTC (permalink / raw)
To: akpm; +Cc: ecashin, dan.carpenter, kernel-janitors, linux-kernel
After calling dev_queue_xmit it is no longer safe to access the
members of the skb.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ed Cashin <ecashin@coraid.com>
---
drivers/block/aoe/aoenet.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index ae56828..2e47404 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -55,12 +55,14 @@ static int
tx(void) __must_hold(&txlock)
{
struct sk_buff *skb;
+ struct net_device *ifp;
while ((skb = skb_dequeue(&skbtxq))) {
spin_unlock_irq(&txlock);
+ ifp = skb->dev;
if (dev_queue_xmit(skb) == NET_XMIT_DROP && net_ratelimit())
pr_warn("aoe: packet could not be sent on %s. %s\n",
- skb->dev ? skb->dev->name : "netif",
+ ifp ? ifp->name : "netif",
"consider increasing tx_queue_len");
spin_lock_irq(&txlock);
}
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] aoe: avoid using skb member after dev_queue_xmit
2012-10-24 18:26 [PATCH] aoe: avoid using skb member after dev_queue_xmit Ed Cashin, Ed Cashin
@ 2012-10-24 22:08 ` Andrew Morton
2012-10-25 6:33 ` Dan Carpenter
0 siblings, 1 reply; 4+ messages in thread
From: Andrew Morton @ 2012-10-24 22:08 UTC (permalink / raw)
To: Ed Cashin; +Cc: dan.carpenter, kernel-janitors, linux-kernel
On Wed, 24 Oct 2012 14:26:13 -0400
Ed Cashin <ecashin@coraid.com> wrote:
> After calling dev_queue_xmit it is no longer safe to access the
> members of the skb.
>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
hm, that was clever. How did Dan detect this bug?
> --- a/drivers/block/aoe/aoenet.c
> +++ b/drivers/block/aoe/aoenet.c
> @@ -55,12 +55,14 @@ static int
> tx(void) __must_hold(&txlock)
> {
> struct sk_buff *skb;
> + struct net_device *ifp;
>
> while ((skb = skb_dequeue(&skbtxq))) {
> spin_unlock_irq(&txlock);
> + ifp = skb->dev;
> if (dev_queue_xmit(skb) == NET_XMIT_DROP && net_ratelimit())
> pr_warn("aoe: packet could not be sent on %s. %s\n",
> - skb->dev ? skb->dev->name : "netif",
> + ifp ? ifp->name : "netif",
> "consider increasing tx_queue_len");
> spin_lock_irq(&txlock);
> }
Queued as a fix against the not-yet-upstream
aoe-print-warning-regarding-a-common-reason-for-dropped-transmits.patch,
thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] aoe: avoid using skb member after dev_queue_xmit
2012-10-24 22:08 ` Andrew Morton
@ 2012-10-25 6:33 ` Dan Carpenter
2012-10-25 17:35 ` Ed Cashin
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2012-10-25 6:33 UTC (permalink / raw)
To: Andrew Morton; +Cc: Ed Cashin, kernel-janitors, linux-kernel
On Wed, Oct 24, 2012 at 03:08:07PM -0700, Andrew Morton wrote:
> On Wed, 24 Oct 2012 14:26:13 -0400
> Ed Cashin <ecashin@coraid.com> wrote:
>
> > After calling dev_queue_xmit it is no longer safe to access the
> > members of the skb.
> >
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> hm, that was clever. How did Dan detect this bug?
It was a Smatch thing, but it wasn't enabled by default. I think I
will enable it. This is the second bug use after dev_queue_xmit()
in two years.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] aoe: avoid using skb member after dev_queue_xmit
2012-10-25 6:33 ` Dan Carpenter
@ 2012-10-25 17:35 ` Ed Cashin
0 siblings, 0 replies; 4+ messages in thread
From: Ed Cashin @ 2012-10-25 17:35 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Andrew Morton, kernel-janitors, linux-kernel
On Oct 25, 2012, at 2:33 AM, Dan Carpenter wrote:
> On Wed, Oct 24, 2012 at 03:08:07PM -0700, Andrew Morton wrote:
>> On Wed, 24 Oct 2012 14:26:13 -0400
>> Ed Cashin <ecashin@coraid.com> wrote:
>>
>>> After calling dev_queue_xmit it is no longer safe to access the
>>> members of the skb.
>>>
>>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> hm, that was clever. How did Dan detect this bug?
>
> It was a Smatch thing, but it wasn't enabled by default. I think I
> will enable it. This is the second bug use after dev_queue_xmit()
> in two years.
OK, no more procrastinating. I'm using smatch from today forward.
--
Ed Cashin
ecashin@coraid.com
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-10-25 17:36 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-10-24 18:26 [PATCH] aoe: avoid using skb member after dev_queue_xmit Ed Cashin, Ed Cashin
2012-10-24 22:08 ` Andrew Morton
2012-10-25 6:33 ` Dan Carpenter
2012-10-25 17:35 ` Ed Cashin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).