linux-kernel - Re: [PATCH net-next v2 4/5] r8152: support skb_add_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <614e322b-fcca-fd4f-f338-76a7fbf84ad1@gmail.com>
Date:   Fri, 16 Aug 2019 08:42:35 +0200
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Hayes Wang <hayeswang@...ltek.com>, netdev@...r.kernel.org
Cc:     nic_swsd@...ltek.com, linux-kernel@...r.kernel.org,
        linux-usb@...r.kernel.org
Subject: Re: [PATCH net-next v2 4/5] r8152: support skb_add_rx_frag



On 8/13/19 5:42 AM, Hayes Wang wrote:
> Use skb_add_rx_frag() to reduce the memory copy for rx data.
> 
> Use a new list of rx_used to store the rx buffer which couldn't be
> reused yet.
> 
> Besides, the total number of rx buffer may be increased or decreased
> dynamically. And it is limited by RTL8152_MAX_RX_AGG.
> 
> Signed-off-by: Hayes Wang <hayeswang@...ltek.com>
>

...

>  			skb->protocol = eth_type_trans(skb, netdev);
>  			rtl_rx_vlan_tag(rx_desc, skb);
>  			if (work_done < budget) {
>  				napi_gro_receive(napi, skb);
>  				work_done++;
>  				stats->rx_packets++;
> -				stats->rx_bytes += pkt_len;
> +				stats->rx_bytes += skb->len;

use-after-free. skb is no longer in your hands after napi_gro_receive()