[lkml]   [2019]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH net 2/3] net: hns3: fix a use after free problem in hns3_nic_maybe_stop_tx()
On 2019/12/3 11:28, David Miller wrote:
> From: Huazhong Tan <>
> Date: Tue, 3 Dec 2019 11:08:54 +0800
>> From: Yunsheng Lin <>
>> Currently, hns3_nic_maybe_stop_tx() uses skb_copy() to linearize a
>> SKB if the BD num required by the SKB does not meet the hardware
>> limitation, and it linearizes the SKB by allocating a new SKB and
>> freeing the old SKB, if hns3_nic_maybe_stop_tx() returns -EBUSY,
>> the sch_direct_xmit() still hold reference to old SKB and try to
>> retransmit the old SKB when dev_hard_start_xmit() return TX_BUSY,
>> which may cause use after freed problem.
>> This patch fixes it by using __skb_linearize() to linearize the
>> SKB in hns3_nic_maybe_stop_tx().
>> Fixes: 51e8439f3496 ("net: hns3: add 8 BD limit for tx flow")
>> Signed-off-by: Yunsheng Lin <>
>> Signed-off-by: Huazhong Tan <>
> That's not what I see.
> You're freeing the SKB in the caller of hns3_nic_maybe_stop_tx()
> in the -ENOMEM case, not the generic qdisc code.
> Standing practice is to always return NETIF_TX_OK in this case
> and just pretend the frame was sent.
> Grep for __skb_linearize use throughout various drivers to see
> what I mean. i40e is just one of several examples.

1. When skb_copy()/__skb_linearize() returns failure, the
hns3_nic_maybe_stop_tx() does return -ENOMEM, and hns3_nic_net_xmit()
does free the skb before returning NETIF_TX_OK, which pretens the frame
was sent.

2. When skb_copy() returns success, the hns3_nic_maybe_stop_tx()
returns -EBUSY when there are not no enough space in the ring to
send the skb to hardware, and hns3_nic_net_xmit() will return
NETDEV_TX_BUSY to the upper layer, the upper layer will resend the old
skb later when driver wakes up the queue, but the old skb has been freed
by the hns3_nic_maybe_stop_tx(). Because when using the skb_copy() to
linearize a skb, it will return a new linearized skb, and the old skb is
freed, the upper layer does not have a reference to the new skb and resend
using the old skb, which casues a use after freed problem.

This patch is trying to fixes the case 2.

Maybe I should mention why hns3_nic_maybe_stop_tx() returns -EBUSY to
better describe the problem?

> .

 \ /
  Last update: 2019-12-03 05:23    [W:0.076 / U:1.584 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site