diff mbox series

[8/8] net: hns3: fix a use after free problem in hns3_nic_maybe_stop_tx()

Message ID 20200709073216.14111-1-ike.pan@canonical.com
State New
Headers show
Series add 8 BD limit for tx flow | expand

Commit Message

Ike Panhc July 9, 2020, 7:32 a.m. UTC 
From: Yunsheng Lin <linyunsheng@huawei.com>

BugLink: https://launchpad.net/bugs/1859756

Currently, hns3_nic_maybe_stop_tx() uses skb_copy() to linearize a
SKB if the BD num required by the SKB does not meet the hardware
limitation, and it linearizes the SKB by allocating a new linearized SKB
and freeing the old SKB, if hns3_nic_maybe_stop_tx() returns -EBUSY
because there are no enough space in the ring to send the linearized
skb to hardware, the sch_direct_xmit() still hold reference to old SKB
and try to retransmit the old SKB when dev_hard_start_xmit() return
TX_BUSY, which may cause use after freed problem.

This patch fixes it by using __skb_linearize() to linearize the
SKB in hns3_nic_maybe_stop_tx().

Fixes: 51e8439f3496 ("net: hns3: add 8 BD limit for tx flow")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(backported from commit d1a37dedcfcf2c01daff5281c3c378876a04e2f4)
Signed-off-by: Ike Panhc <ike.pan@canonical.com>
---
 .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)
diff mbox series

Patch

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 26e9b07297ba..06d63d45e499 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1154,26 +1154,21 @@  static unsigned int hns3_nic_bd_num(struct sk_buff *skb)
 
 static int hns3_nic_maybe_stop_tx(struct hns3_enet_ring *ring,
 				  struct net_device *netdev,
-				  struct sk_buff **out_skb)
+				  struct sk_buff *skb)
 {
 	struct hns3_nic_priv *priv = netdev_priv(netdev);
-	struct sk_buff *skb = *out_skb;
+	struct hns3_nic_ring_data *ring_data =
+		&tx_ring_data(priv, skb->queue_mapping);
 	unsigned int bd_num;
 
 	bd_num = hns3_nic_bd_num(skb);
 	if (unlikely(bd_num > HNS3_MAX_BD_NUM_NORMAL)) {
-		struct sk_buff *new_skb;
-
-		/* manual split the send packet */
-		new_skb = skb_copy(skb, GFP_ATOMIC);
-		if (!new_skb)
+		if (__skb_linearize(skb))
 			return -ENOMEM;
-		dev_kfree_skb_any(skb);
-		*out_skb = new_skb;
 
-		bd_num = hns3_nic_bd_num(new_skb);
-		if ((skb_is_gso(new_skb) && bd_num > HNS3_MAX_BD_NUM_TSO) ||
-		    (!skb_is_gso(new_skb) && bd_num > HNS3_MAX_BD_NUM_NORMAL))
+		bd_num = hns3_nic_bd_num(skb);
+		if ((skb_is_gso(skb) && bd_num > HNS3_MAX_BD_NUM_TSO) ||
+		    (!skb_is_gso(skb) && bd_num > HNS3_MAX_BD_NUM_NORMAL))
 			return -ENOMEM;
 
 		u64_stats_update_begin(&ring->syncp);
@@ -1185,7 +1180,7 @@  static int hns3_nic_maybe_stop_tx(struct hns3_enet_ring *ring,
 		return bd_num;
 
 
-	netif_stop_subqueue(netdev, ring->queue_index);
+	netif_stop_subqueue(netdev, ring_data->queue_index);
 	smp_mb(); /* Memory barrier before checking ring_space */
 
 	/* Start queue in case hns3_clean_tx_ring has just made room
@@ -1194,7 +1189,7 @@  static int hns3_nic_maybe_stop_tx(struct hns3_enet_ring *ring,
 	 */
 	if (ring_space(ring) >= bd_num && netif_carrier_ok(netdev) &&
 	    !test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
-		netif_start_subqueue(netdev, ring->queue_index);
+		netif_start_subqueue(netdev, ring_data->queue_index);
 		return bd_num;
 	}
 
@@ -1253,7 +1248,7 @@  netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 	/* Prefetch the data used later */
 	prefetch(skb->data);
 
-	buf_num = hns3_nic_maybe_stop_tx(ring, netdev, &skb);
+	buf_num = hns3_nic_maybe_stop_tx(ring, netdev, skb);
 	if (unlikely(buf_num <= 0)) {
 		if (buf_num == -EBUSY) {
 			u64_stats_update_begin(&ring->syncp);