* [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY
@ 2019-09-04 9:42 Mao Wenan
2019-09-04 9:50 ` Thomas Bogendoerfer
2019-09-04 10:19 ` Eric Dumazet
0 siblings, 2 replies; 6+ messages in thread
From: Mao Wenan @ 2019-09-04 9:42 UTC (permalink / raw)
To: tsbogend, davem; +Cc: netdev, linux-kernel, kernel-janitors, Mao Wenan
When dma_map_single is failed to map buffer, skb can't be freed
before sonic driver return to stack with NETDEV_TX_BUSY, because
this skb may be requeued to qdisc, it might trigger use-after-free.
Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
Signed-off-by: Mao Wenan <maowenan@huawei.com>
---
drivers/net/ethernet/natsemi/sonic.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index d0a01e8f000a..248a8f22a33b 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -233,7 +233,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
if (!laddr) {
printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
- dev_kfree_skb(skb);
return NETDEV_TX_BUSY;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY
2019-09-04 9:42 [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY Mao Wenan
@ 2019-09-04 9:50 ` Thomas Bogendoerfer
2019-09-04 10:19 ` Eric Dumazet
1 sibling, 0 replies; 6+ messages in thread
From: Thomas Bogendoerfer @ 2019-09-04 9:50 UTC (permalink / raw)
To: Mao Wenan; +Cc: davem, netdev, linux-kernel, kernel-janitors
On Wed, Sep 04, 2019 at 05:42:11PM +0800, Mao Wenan wrote:
> When dma_map_single is failed to map buffer, skb can't be freed
> before sonic driver return to stack with NETDEV_TX_BUSY, because
> this skb may be requeued to qdisc, it might trigger use-after-free.
>
> Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
> Signed-off-by: Mao Wenan <maowenan@huawei.com>
> ---
> drivers/net/ethernet/natsemi/sonic.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
> index d0a01e8f000a..248a8f22a33b 100644
> --- a/drivers/net/ethernet/natsemi/sonic.c
> +++ b/drivers/net/ethernet/natsemi/sonic.c
> @@ -233,7 +233,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
> laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
> if (!laddr) {
> printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
> - dev_kfree_skb(skb);
> return NETDEV_TX_BUSY;
> }
Reviewed-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Thomas.
--
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea. [ RFC1925, 2.3 ]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY
2019-09-04 9:42 [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY Mao Wenan
2019-09-04 9:50 ` Thomas Bogendoerfer
@ 2019-09-04 10:19 ` Eric Dumazet
2019-09-05 0:56 ` maowenan
1 sibling, 1 reply; 6+ messages in thread
From: Eric Dumazet @ 2019-09-04 10:19 UTC (permalink / raw)
To: Mao Wenan, tsbogend, davem; +Cc: netdev, linux-kernel, kernel-janitors
On 9/4/19 11:42 AM, Mao Wenan wrote:
> When dma_map_single is failed to map buffer, skb can't be freed
> before sonic driver return to stack with NETDEV_TX_BUSY, because
> this skb may be requeued to qdisc, it might trigger use-after-free.
>
> Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
> Signed-off-by: Mao Wenan <maowenan@huawei.com>
> ---
> drivers/net/ethernet/natsemi/sonic.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
> index d0a01e8f000a..248a8f22a33b 100644
> --- a/drivers/net/ethernet/natsemi/sonic.c
> +++ b/drivers/net/ethernet/natsemi/sonic.c
> @@ -233,7 +233,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
> laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
> if (!laddr) {
> printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
> - dev_kfree_skb(skb);
> return NETDEV_TX_BUSY;
> }
>
>
That is the wrong way to fix this bug.
What guarantee do we have that the mapping operation will succeed next time we attempt
the transmit (and the dma_map_single() operation) ?
NETDEV_TX_BUSY is very dangerous, this might trigger an infinite loop.
I would rather leave the dev_kfree_skb(skb), and return NETDEV_TX_OK
Also the printk(KERN_ERR ...) should be replaced by pr_err_ratelimited(...)
NETDEV_TX_BUSY really should only be used by drivers that call netif_tx_stop_queue()
at the wrong moment.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY
2019-09-04 10:19 ` Eric Dumazet
@ 2019-09-05 0:56 ` maowenan
2019-09-05 1:57 ` [PATCH v2 net] net: sonic: return NETDEV_TX_OK if failed to map buffer Mao Wenan
0 siblings, 1 reply; 6+ messages in thread
From: maowenan @ 2019-09-05 0:56 UTC (permalink / raw)
To: Eric Dumazet, tsbogend, davem; +Cc: netdev, linux-kernel, kernel-janitors
On 2019/9/4 18:19, Eric Dumazet wrote:
>
>
> On 9/4/19 11:42 AM, Mao Wenan wrote:
>> When dma_map_single is failed to map buffer, skb can't be freed
>> before sonic driver return to stack with NETDEV_TX_BUSY, because
>> this skb may be requeued to qdisc, it might trigger use-after-free.
>>
>> Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
>> Signed-off-by: Mao Wenan <maowenan@huawei.com>
>> ---
>> drivers/net/ethernet/natsemi/sonic.c | 1 -
>> 1 file changed, 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
>> index d0a01e8f000a..248a8f22a33b 100644
>> --- a/drivers/net/ethernet/natsemi/sonic.c
>> +++ b/drivers/net/ethernet/natsemi/sonic.c
>> @@ -233,7 +233,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
>> laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
>> if (!laddr) {
>> printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
>> - dev_kfree_skb(skb);
>> return NETDEV_TX_BUSY;
>> }
>>
>>
>
> That is the wrong way to fix this bug.
>
> What guarantee do we have that the mapping operation will succeed next time we attempt
> the transmit (and the dma_map_single() operation) ?
>
> NETDEV_TX_BUSY is very dangerous, this might trigger an infinite loop.
>
> I would rather leave the dev_kfree_skb(skb), and return NETDEV_TX_OK
yes, right, it will go to infinite loop if dma_map_single failed always.
v2 will be sent later.
>
> Also the printk(KERN_ERR ...) should be replaced by pr_err_ratelimited(...)
>
> NETDEV_TX_BUSY really should only be used by drivers that call netif_tx_stop_queue()
> at the wrong moment.
It will call netif_tx_stop_queue() then return NETDEV_TX_BUSY, and give a chance to
netif_tx_wake_queue(), then stack can be resent packet to driver?
>
> .
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 net] net: sonic: return NETDEV_TX_OK if failed to map buffer
2019-09-05 0:56 ` maowenan
@ 2019-09-05 1:57 ` Mao Wenan
2019-09-06 13:05 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: Mao Wenan @ 2019-09-05 1:57 UTC (permalink / raw)
To: eric.dumazet, tsbogend, davem
Cc: netdev, linux-kernel, kernel-janitors, Mao Wenan
NETDEV_TX_BUSY really should only be used by drivers that call
netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
failed to map tx DMA buffer, it might trigger an infinite loop.
This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
printk to pr_err_ratelimited.
Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
Signed-off-by: Mao Wenan <maowenan@huawei.com>
---
v2: change subject and description of patch, use NETDEV_TX_OK instead of NETDEV_TX_BUSY.
drivers/net/ethernet/natsemi/sonic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index d0a01e8f000a..18fd62fbfb64 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -232,9 +232,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
if (!laddr) {
- printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
+ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
dev_kfree_skb(skb);
- return NETDEV_TX_BUSY;
+ return NETDEV_TX_OK;
}
sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2 net] net: sonic: return NETDEV_TX_OK if failed to map buffer
2019-09-05 1:57 ` [PATCH v2 net] net: sonic: return NETDEV_TX_OK if failed to map buffer Mao Wenan
@ 2019-09-06 13:05 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2019-09-06 13:05 UTC (permalink / raw)
To: maowenan; +Cc: eric.dumazet, tsbogend, netdev, linux-kernel, kernel-janitors
From: Mao Wenan <maowenan@huawei.com>
Date: Thu, 5 Sep 2019 09:57:12 +0800
> NETDEV_TX_BUSY really should only be used by drivers that call
> netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
> failed to map tx DMA buffer, it might trigger an infinite loop.
> This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
> printk to pr_err_ratelimited.
>
> Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
> Signed-off-by: Mao Wenan <maowenan@huawei.com>
Applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-09-06 13:05 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-04 9:42 [PATCH net] net: sonic: remove dev_kfree_skb before return NETDEV_TX_BUSY Mao Wenan
2019-09-04 9:50 ` Thomas Bogendoerfer
2019-09-04 10:19 ` Eric Dumazet
2019-09-05 0:56 ` maowenan
2019-09-05 1:57 ` [PATCH v2 net] net: sonic: return NETDEV_TX_OK if failed to map buffer Mao Wenan
2019-09-06 13:05 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).