linux-kernel - Re: [PATCH v2] wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87tu172np9.fsf@toke.dk>
Date:   Wed, 04 Jan 2023 00:38:42 +0100
From:   Toke Høiland-Jørgensen <toke@...e.dk>
To:     Fedor Pchelkin <pchelkin@...ras.ru>, Kalle Valo <kvalo@...nel.org>
Cc:     Fedor Pchelkin <pchelkin@...ras.ru>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Zekun Shen <bruceshenzk@...il.com>,
        Joe Perches <joe@...ches.com>,
        "John W. Linville" <linville@...driver.com>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Alexey Khoroshilov <khoroshilov@...ras.ru>,
        lvc-project@...uxtesting.org
Subject: Re: [PATCH v2] wifi: ath9k: hif_usb: clean up skbs if
 ath9k_hif_usb_rx_stream() fails

Fedor Pchelkin <pchelkin@...ras.ru> writes:

>> Hmm, so in the other error cases (if SKB allocation fails), we just
>> 'goto err' and call the receive handler for the packets already in
>> skb_pool. Why can't we do the same here?
>
> If SKB allocation fails, then the packets already in skb_pool should be
> processed by htc rx handler, yes. About the other two cases: if pkt_tag or
> pkt_len is invalid, then the whole SKB is considered invalid and dropped.
> That is what the statistics macros tell. So I think we should not process
> packets from skb_pool which are associated with a dropped SKB. And so just
> free them instead.

Hmm, okay, but if we're counting packets, your patch is not incrementing
any drop counters for the extra SKBs it's dropping either? They would
previously have been counted as 'RX_STAT_INC(hif_dev, skb_allocated)',
so shouldn't they now be counted as 'skb_dropped' as well? The single
counter increase inside the err if statements refers to the skb that's
the function parameter (which AFAICT is a different kind of skb than the
ones being allocated and processed in that loop? it's being split into
chunks or?).

>> Also, I think there's another bug in that function, which this change
>> will make worse? Specifically, in the start of that function,
>> hif_dev->remain_skb is moved to skb_pool[0], but not cleared from
>> hif_dev itself. So if we then hit the invalid check and free it, the
>> next time the function is called, we'll get the same remain_skb pointer,
>> which has now been freed.
>
> Sorry, I missed that somehow.
> Moving 'hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;' after
> "ath9k_htc: RX memory allocation error\n" error path should be done, too.
> hif_dev->rx_remain_len is zeroed after remain_skb processing, so we cannot
> reference hif_dev->remain_skb unless we explicitly allocate successfully a
> new one (making rx_remain_len non zero).
>
>> So I think we'll need to clear out hif_dev->remain_skb after moving it
>> to skb_pool. Care to add that as well?
>
> Yes, this must be done. I'll add it to patch v3.

OK, cool!