linux-kernel - Re: [PATCH net 3/3] hinic: fix bug of send pkts while setting channels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fa78a6e8-c21e-ca4a-e40b-4109fb8a78d5@gmail.com>
Date:   Wed, 2 Sep 2020 12:16:57 +0200
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Luo bin <luobin9@...wei.com>, davem@...emloft.net
Cc:     linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        luoxianjun@...wei.com, yin.yinshi@...wei.com,
        cloud.wangxiaoyun@...wei.com, chiqijun@...wei.com
Subject: Re: [PATCH net 3/3] hinic: fix bug of send pkts while setting
 channels



On 9/2/20 2:41 AM, Luo bin wrote:
> When calling hinic_close in hinic_set_channels, netif_carrier_off
> and netif_tx_disable are excuted, and TX host resources are freed
> after that. Core may call hinic_xmit_frame to send pkt after
> netif_tx_disable within a short time, so we should judge whether
> carrier is on before sending pkt otherwise the resources that
> have already been freed in hinic_close may be accessed.
> 
> Fixes: 2eed5a8b614b ("hinic: add set_channels ethtool_ops support")
> Signed-off-by: Luo bin <luobin9@...wei.com>
> ---
>  drivers/net/ethernet/huawei/hinic/hinic_tx.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
> index a97498ee6914..a0662552a39c 100644
> --- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c
> +++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
> @@ -531,6 +531,11 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
>  	struct hinic_txq *txq;
>  	struct hinic_qp *qp;
>  
> +	if (unlikely(!netif_carrier_ok(netdev))) {
> +		dev_kfree_skb_any(skb);
> +		return NETDEV_TX_OK;
> +	}
> +
>  	txq = &nic_dev->txqs[q_id];
>  	qp = container_of(txq->sq, struct hinic_qp, sq);
>  
> 

Adding this kind of tests in fast path seems a big hammer to me.

See https://marc.info/?l=linux-netdev&m=159903844423389&w=2   for a similar problem.

Normally, after hinic_close() operation, no packet should be sent by core networking stack.

Trying to work around some core networking issue in each driver is a dead end.