lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 19 Jan 2022 23:45:40 +0100 From: Miquel Raynal <miquel.raynal@...tlin.com> To: Alexander Aring <alex.aring@...il.com> Cc: Stefan Schmidt <stefan@...enfreihafen.org>, linux-wpan - ML <linux-wpan@...r.kernel.org>, "open list:NETWORKING [GENERAL]" <netdev@...r.kernel.org>, "linux-wireless@...r.kernel.org Wireless" <linux-wireless@...r.kernel.org>, David Girault <david.girault@...vo.com>, Romuald Despres <romuald.despres@...vo.com>, Frederic Blain <frederic.blain@...vo.com>, Nicolas Schodet <nico@...fr.eu.org>, Michael Hennerich <michael.hennerich@...log.com>, Jakub Kicinski <kuba@...nel.org>, Varka Bhadram <varkabhadram@...il.com>, Xue Liu <liuxuenetmail@...il.com>, Alan Ott <alan@...nal11.us>, Thomas Petazzoni <thomas.petazzoni@...tlin.com> Subject: Re: [PATCH v3 17/41] net: ieee802154: at86rf230: Call the complete helper when a transmission is over Hi Alexander, alex.aring@...il.com wrote on Mon, 17 Jan 2022 19:36:39 -0500: > Hi, > > On Mon, 17 Jan 2022 at 19:34, Alexander Aring <alex.aring@...il.com> wrote: > > > > Hi, > > > > On Mon, 17 Jan 2022 at 06:55, Miquel Raynal <miquel.raynal@...tlin.com> wrote: > > > > > > ieee802154_xmit_complete() is the right helper to call when a > > > transmission is over. The fact that it completed or not is not really a > > > question, but drivers must tell the core that the completion is over, > > > even if it was canceled. Do not call ieee802154_wake_queue() manually, > > > in order to let full control of this task to the core. > > > > > > By using the complete helper we also avoid leacking the skb structure. > > > > > > Signed-off-by: Miquel Raynal <miquel.raynal@...tlin.com> > > > --- > > > drivers/net/ieee802154/at86rf230.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c > > > index 583f835c317a..1941e1f3d2ef 100644 > > > --- a/drivers/net/ieee802154/at86rf230.c > > > +++ b/drivers/net/ieee802154/at86rf230.c > > > @@ -343,7 +343,7 @@ at86rf230_async_error_recover_complete(void *context) > > > if (ctx->free) > > > kfree(ctx); > > > > > > - ieee802154_wake_queue(lp->hw); > > > + ieee802154_xmit_complete(lp->hw, lp->tx_skb, false); > > > > also this lp->tx_skb can be a dangled pointer, after xmit_complete() > > we need to set it to NULL in a xmit_error() we can check on NULL > > before calling kfree_skb(). I've created a xmit_error() helper as suggested, which call dev_kfree_skb_any() instead of *consume_skb*(). > > forget the NULL checking, it's already done by core. Indeed, it is. > However in some > cases this is called with a dangled pointer on lp->tx_skb. I've fixed that by setting it to NULL after the call to the xmit_error helper. > > - Alex Thanks, Miquèl
Powered by blists - more mailing lists