[PATCH net v2 0/3] net: hns: bug fix for HNS driver

[PATCH net v2 0/3] net: hns: bug fix for HNS driver

[Yankejian]

From: lipeng <lipeng321@huawei.com>

This series adds support defered probe when mdio or mbigen module
insmod behind HNS driver, and fixes a bug that a skb has been
freed, but it may be still used in driver.

change log:
V1 -> V2:
1. Return appropriate errno in hns_mac_register_phy;

lipeng (3):
  net: hns: support deferred probe when can not obtain irq
  net: hns: support deferred probe when no mdio
  net: hns: fixed bug that skb used after kfree

 drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c  | 39 ++++++++++++++++++----
 drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 12 +++++++
 drivers/net/ethernet/hisilicon/hns/hns_enet.c      | 22 ++++++------
 drivers/net/ethernet/hisilicon/hns/hns_enet.h      |  6 ++--
 4 files changed, 58 insertions(+), 21 deletions(-)

-- 
1.9.1

[PATCH net v2 1/3] net: hns: support deferred probe when can not obtain irq

[Yankejian]

From: lipeng <lipeng321@huawei.com>

In the hip06 and hip07 SoCs, the interrupt lines from the
DSAF controllers are connected to mbigen hw module.
The mbigen module is probed with module_init, and, as such,
is not guaranteed to probe before the HNS driver. So we need
to support deferred probe.

We check for probe deferral in the hw layer probe, so we not
probe into the main layer and memories, etc., to later learn
that we need to defer the probe.

Signed-off-by: lipeng <lipeng321@huawei.com>
Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 403ea9d..2da5b42 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -2971,6 +2971,18 @@ static int hns_dsaf_probe(struct platform_device *pdev)
 	struct dsaf_device *dsaf_dev;
 	int ret;
 
+	/*
+	 * Check if we should defer the probe before we probe the
+	 * dsaf, as it's hard to defer later on.
+	 */
+	ret = platform_get_irq(pdev, 0);
+	if (ret < 0) {
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Cannot obtain irq\n");
+
+		return ret;
+	}
+
 	dsaf_dev = hns_dsaf_alloc_dev(&pdev->dev, sizeof(struct dsaf_drv_priv));
 	if (IS_ERR(dsaf_dev)) {
 		ret = PTR_ERR(dsaf_dev);
-- 
1.9.1

Re: [PATCH net v2 1/3] net: hns: support deferred probe when can not obtain irq

[Matthias Brugger]

On 21/04/17 09:44, Yankejian wrote:
> From: lipeng <lipeng321@huawei.com>
>
> In the hip06 and hip07 SoCs, the interrupt lines from the
> DSAF controllers are connected to mbigen hw module.
> The mbigen module is probed with module_init, and, as such,
> is not guaranteed to probe before the HNS driver. So we need
> to support deferred probe.
>
> We check for probe deferral in the hw layer probe, so we not
> probe into the main layer and memories, etc., to later learn
> that we need to defer the probe.
>

Why? This looks like a hack.
 From what I see, we can handle EPROBE_DEFER easily inside hns_ppe_init 
checking the return value of hns_rcb_get_cfg. Like you do in 2/3 of this 
series.

Regards,
Matthias

> Signed-off-by: lipeng <lipeng321@huawei.com>
> Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>
> ---
>  drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
> index 403ea9d..2da5b42 100644
> --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
> +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
> @@ -2971,6 +2971,18 @@ static int hns_dsaf_probe(struct platform_device *pdev)
>  	struct dsaf_device *dsaf_dev;
>  	int ret;
>
> +	/*
> +	 * Check if we should defer the probe before we probe the
> +	 * dsaf, as it's hard to defer later on.
> +	 */
> +	ret = platform_get_irq(pdev, 0);
> +	if (ret < 0) {
> +		if (ret != -EPROBE_DEFER)
> +			dev_err(&pdev->dev, "Cannot obtain irq\n");
> +
> +		return ret;
> +	}
> +
>  	dsaf_dev = hns_dsaf_alloc_dev(&pdev->dev, sizeof(struct dsaf_drv_priv));
>  	if (IS_ERR(dsaf_dev)) {
>  		ret = PTR_ERR(dsaf_dev);
>

Re: [PATCH net v2 1/3] net: hns: support deferred probe when can not obtain irq

[Matthias Brugger]

On 24/04/17 13:43, lipeng (Y) wrote:
>
>
> On 2017/4/24 18:28, Matthias Brugger wrote:
>> On 21/04/17 09:44, Yankejian wrote:
>>> From: lipeng <lipeng321@huawei.com>
>>>
>>> In the hip06 and hip07 SoCs, the interrupt lines from the
>>> DSAF controllers are connected to mbigen hw module.
>>> The mbigen module is probed with module_init, and, as such,
>>> is not guaranteed to probe before the HNS driver. So we need
>>> to support deferred probe.
>>>
>>> We check for probe deferral in the hw layer probe, so we not
>>> probe into the main layer and memories, etc., to later learn
>>> that we need to defer the probe.
>>>
>>
>> Why? This looks like a hack.
>> From what I see, we can handle EPROBE_DEFER easily inside hns_ppe_init
>> checking the return value of hns_rcb_get_cfg. Like you do in 2/3 of
>> this series.
>>
>> Regards,
>> Matthias
> Hi Matthias,
>
> mdio && phy is not necessary condition, and port can work well  for port
> + SFP (without mdio &&phy).
>
> BUT irq is the necessary condition,  port can not work well without irq.
>
> So, I check IRQ first,and do not probe dsaf if can't obtain irq(1/3 of
> this series),   and check mdio only when there is phy(2/3 of this series).
>
> And thanks for your review.

I think I didn't explained myself good enough.
I was suggesting the following (not even compile tested):

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c 
b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index eba406bea52f..be38d47bc399 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -510,7 +510,9 @@ int hns_ppe_init(struct dsaf_device *dsaf_dev)

                 hns_ppe_get_cfg(dsaf_dev->ppe_common[i]);

-               hns_rcb_get_cfg(dsaf_dev->rcb_common[i]);
+               ret = hns_rcb_get_cfg(dsaf_dev->rcb_common[i]);
+               if (reg < 0)
+                       goto get_cfg_fail;
         }

         for (i = 0; i < HNS_PPE_COM_NUM; i++)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c 
b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index c20a0f4f8f02..c7e801d0c3b7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -492,7 +492,7 @@ static int hns_rcb_get_base_irq_idx(struct 
rcb_common_cb *rcb_common)
   *hns_rcb_get_cfg - get rcb config
   *@rcb_common: rcb common device
   */
-void hns_rcb_get_cfg(struct rcb_common_cb *rcb_common)
+int hns_rcb_get_cfg(struct rcb_common_cb *rcb_common)
  {
         struct ring_pair_cb *ring_pair_cb;
         u32 i;
@@ -517,10 +517,18 @@ void hns_rcb_get_cfg(struct rcb_common_cb *rcb_common)
                 ring_pair_cb->virq[HNS_RCB_IRQ_IDX_RX] =
                 is_ver1 ? platform_get_irq(pdev, base_irq_idx + i * 2 + 
1) :
                           platform_get_irq(pdev, base_irq_idx + i * 3);
+
+               if ((ring_pair_cb->virq[HNS_RCB_IRQ_IDX_TX] == 
-EPROBE_DEFER) ||
+                   (ring_pair_cb->virq[HNS_RCB_IRQ_IDX_RX] == 
-EPROBE_DEFER)) {
+                       return -EPROBE_DEFER;
+               }
+
                 ring_pair_cb->q.phy_base =
 
RCB_COMM_BASE_TO_RING_BASE(rcb_common->phy_base, i);
                 hns_rcb_ring_pair_get_cfg(ring_pair_cb);
         }
+
+       return 0;
  }

  /**


Regards,
Matthias

>
> lipeng
>
>>
>>> Signed-off-by: lipeng <lipeng321@huawei.com>
>>> Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>
>>> ---
>>>  drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 12 ++++++++++++
>>>  1 file changed, 12 insertions(+)
>>>
>>> diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>> b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>> index 403ea9d..2da5b42 100644
>>> --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>> +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>> @@ -2971,6 +2971,18 @@ static int hns_dsaf_probe(struct
>>> platform_device *pdev)
>>>      struct dsaf_device *dsaf_dev;
>>>      int ret;
>>>
>>> +    /*
>>> +     * Check if we should defer the probe before we probe the
>>> +     * dsaf, as it's hard to defer later on.
>>> +     */
>>> +    ret = platform_get_irq(pdev, 0);
>>> +    if (ret < 0) {
>>> +        if (ret != -EPROBE_DEFER)
>>> +            dev_err(&pdev->dev, "Cannot obtain irq\n");
>>> +
>>> +        return ret;
>>> +    }
>>> +
>>>      dsaf_dev = hns_dsaf_alloc_dev(&pdev->dev, sizeof(struct
>>> dsaf_drv_priv));
>>>      if (IS_ERR(dsaf_dev)) {
>>>          ret = PTR_ERR(dsaf_dev);
>>>
>>
>> .
>>
>

Re: [PATCH net v2 1/3] net: hns: support deferred probe when can not obtain irq

[lipeng (Y)]

On 2017/4/24 22:47, Matthias Brugger wrote:
>
>
> On 24/04/17 13:43, lipeng (Y) wrote:
>>
>>
>> On 2017/4/24 18:28, Matthias Brugger wrote:
>>> On 21/04/17 09:44, Yankejian wrote:
>>>> From: lipeng <lipeng321@huawei.com>
>>>>
>>>> In the hip06 and hip07 SoCs, the interrupt lines from the
>>>> DSAF controllers are connected to mbigen hw module.
>>>> The mbigen module is probed with module_init, and, as such,
>>>> is not guaranteed to probe before the HNS driver. So we need
>>>> to support deferred probe.
>>>>
>>>> We check for probe deferral in the hw layer probe, so we not
>>>> probe into the main layer and memories, etc., to later learn
>>>> that we need to defer the probe.
>>>>
>>>
>>> Why? This looks like a hack.
>>> From what I see, we can handle EPROBE_DEFER easily inside hns_ppe_init
>>> checking the return value of hns_rcb_get_cfg. Like you do in 2/3 of
>>> this series.
>>>
>>> Regards,
>>> Matthias
>> Hi Matthias,
>>
>> mdio && phy is not necessary condition, and port can work well  for port
>> + SFP (without mdio &&phy).
>>
>> BUT irq is the necessary condition,  port can not work well without irq.
>>
>> So, I check IRQ first,and do not probe dsaf if can't obtain irq(1/3 of
>> this series),   and check mdio only when there is phy(2/3 of this 
>> series).
>>
>> And thanks for your review.
>
> I think I didn't explained myself good enough.
> I was suggesting the following (not even compile tested):
>
> diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c 
> b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
> index eba406bea52f..be38d47bc399 100644
> --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
> +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
> @@ -510,7 +510,9 @@ int hns_ppe_init(struct dsaf_device *dsaf_dev)
>
>                 hns_ppe_get_cfg(dsaf_dev->ppe_common[i]);
>
> -               hns_rcb_get_cfg(dsaf_dev->rcb_common[i]);
> +               ret = hns_rcb_get_cfg(dsaf_dev->rcb_common[i]);
> +               if (reg < 0)
> +                       goto get_cfg_fail;
>         }
>
>         for (i = 0; i < HNS_PPE_COM_NUM; i++)
> diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c 
> b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
> index c20a0f4f8f02..c7e801d0c3b7 100644
> --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
> +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
> @@ -492,7 +492,7 @@ static int hns_rcb_get_base_irq_idx(struct 
> rcb_common_cb *rcb_common)
>   *hns_rcb_get_cfg - get rcb config
>   *@rcb_common: rcb common device
>   */
> -void hns_rcb_get_cfg(struct rcb_common_cb *rcb_common)
> +int hns_rcb_get_cfg(struct rcb_common_cb *rcb_common)
>  {
>         struct ring_pair_cb *ring_pair_cb;
>         u32 i;
> @@ -517,10 +517,18 @@ void hns_rcb_get_cfg(struct rcb_common_cb 
> *rcb_common)
>                 ring_pair_cb->virq[HNS_RCB_IRQ_IDX_RX] =
>                 is_ver1 ? platform_get_irq(pdev, base_irq_idx + i * 2 
> + 1) :
>                           platform_get_irq(pdev, base_irq_idx + i * 3);
> +
> +               if ((ring_pair_cb->virq[HNS_RCB_IRQ_IDX_TX] == 
> -EPROBE_DEFER) ||
> +                   (ring_pair_cb->virq[HNS_RCB_IRQ_IDX_RX] == 
> -EPROBE_DEFER)) {
> +                       return -EPROBE_DEFER;
> +               }
> +
>                 ring_pair_cb->q.phy_base =
>
> RCB_COMM_BASE_TO_RING_BASE(rcb_common->phy_base, i);
>                 hns_rcb_ring_pair_get_cfg(ring_pair_cb);
>         }
> +
> +       return 0;
>  }
>
>  /**
>
>
> Regards,
> Matthias
Thanks,  I will take your advice and test it.

>
>>
>> lipeng
>>
>>>
>>>> Signed-off-by: lipeng <lipeng321@huawei.com>
>>>> Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>
>>>> ---
>>>>  drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 12 ++++++++++++
>>>>  1 file changed, 12 insertions(+)
>>>>
>>>> diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>>> b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>>> index 403ea9d..2da5b42 100644
>>>> --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>>> +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
>>>> @@ -2971,6 +2971,18 @@ static int hns_dsaf_probe(struct
>>>> platform_device *pdev)
>>>>      struct dsaf_device *dsaf_dev;
>>>>      int ret;
>>>>
>>>> +    /*
>>>> +     * Check if we should defer the probe before we probe the
>>>> +     * dsaf, as it's hard to defer later on.
>>>> +     */
>>>> +    ret = platform_get_irq(pdev, 0);
>>>> +    if (ret < 0) {
>>>> +        if (ret != -EPROBE_DEFER)
>>>> +            dev_err(&pdev->dev, "Cannot obtain irq\n");
>>>> +
>>>> +        return ret;
>>>> +    }
>>>> +
>>>>      dsaf_dev = hns_dsaf_alloc_dev(&pdev->dev, sizeof(struct
>>>> dsaf_drv_priv));
>>>>      if (IS_ERR(dsaf_dev)) {
>>>>          ret = PTR_ERR(dsaf_dev);
>>>>
>>>
>>> .
>>>
>>
> .
>

[PATCH net v2 2/3] net: hns: support deferred probe when no mdio

[Yankejian]

From: lipeng <lipeng321@huawei.com>

In the hip06 and hip07 SoCs, phy connect to mdio bus.The mdio
module is probed with module_init, and, as such,
is not guaranteed to probe before the HNS driver. So we need
to support deferred probe.

We check for probe deferral in the mac init, so we not init DSAF
when there is no mdio, and free all resource, to later learn that
we need to defer the probe.

Signed-off-by: lipeng <lipeng321@huawei.com>
Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>

---
change log:
V1 -> V2:
1. Return appropriate errno in hns_mac_register_phy;
---
---
 drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 39 +++++++++++++++++++----
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index bdd8cdd..8c00e09 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -735,6 +735,8 @@ static int hns_mac_init_ex(struct hns_mac_cb *mac_cb)
 	rc = phy_device_register(phy);
 	if (rc) {
 		phy_device_free(phy);
+		dev_err(&mdio->dev, "registered phy fail at address %i\n",
+			addr);
 		return -ENODEV;
 	}
 
@@ -745,7 +747,7 @@ static int hns_mac_init_ex(struct hns_mac_cb *mac_cb)
 	return 0;
 }
 
-static void hns_mac_register_phy(struct hns_mac_cb *mac_cb)
+static int hns_mac_register_phy(struct hns_mac_cb *mac_cb)
 {
 	struct acpi_reference_args args;
 	struct platform_device *pdev;
@@ -755,24 +757,39 @@ static void hns_mac_register_phy(struct hns_mac_cb *mac_cb)
 
 	/* Loop over the child nodes and register a phy_device for each one */
 	if (!to_acpi_device_node(mac_cb->fw_port))
-		return;
+		return -ENODEV;
 
 	rc = acpi_node_get_property_reference(
 			mac_cb->fw_port, "mdio-node", 0, &args);
 	if (rc)
-		return;
+		return rc;
 
 	addr = hns_mac_phy_parse_addr(mac_cb->dev, mac_cb->fw_port);
 	if (addr < 0)
-		return;
+		return addr;
 
 	/* dev address in adev */
 	pdev = hns_dsaf_find_platform_device(acpi_fwnode_handle(args.adev));
+	if (!pdev) {
+		dev_err(mac_cb->dev, "mac%d mdio pdev is NULL\n",
+			mac_cb->mac_id);
+		return  -EINVAL;
+	}
+
 	mii_bus = platform_get_drvdata(pdev);
+	if (!mii_bus) {
+		dev_err(mac_cb->dev,
+			"mac%d mdio is NULL, dsaf will probe again later\n",
+			mac_cb->mac_id);
+		return -EPROBE_DEFER;
+	}
+
 	rc = hns_mac_register_phydev(mii_bus, mac_cb, addr);
 	if (!rc)
 		dev_dbg(mac_cb->dev, "mac%d register phy addr:%d\n",
 			mac_cb->mac_id, addr);
+
+	return rc;
 }
 
 #define MAC_MEDIA_TYPE_MAX_LEN		16
@@ -793,7 +810,7 @@ static void hns_mac_register_phy(struct hns_mac_cb *mac_cb)
  *@np:device node
  * return: 0 --success, negative --fail
  */
-static int  hns_mac_get_info(struct hns_mac_cb *mac_cb)
+static int hns_mac_get_info(struct hns_mac_cb *mac_cb)
 {
 	struct device_node *np;
 	struct regmap *syscon;
@@ -903,7 +920,15 @@ static int  hns_mac_get_info(struct hns_mac_cb *mac_cb)
 			}
 		}
 	} else if (is_acpi_node(mac_cb->fw_port)) {
-		hns_mac_register_phy(mac_cb);
+		ret = hns_mac_register_phy(mac_cb);
+		/*
+		 * Mac can work well if there is phy or not.If the port don't
+		 * connect with phy, the return value will be ignored. Only
+		 * when there is phy but can't find mdio bus, the return value
+		 * will be handled.
+		 */
+		if (ret == -EPROBE_DEFER)
+			return ret;
 	} else {
 		dev_err(mac_cb->dev, "mac%d cannot find phy node\n",
 			mac_cb->mac_id);
@@ -1065,6 +1090,7 @@ int hns_mac_init(struct dsaf_device *dsaf_dev)
 			dsaf_dev->mac_cb[port_id] = mac_cb;
 		}
 	}
+
 	/* init mac_cb for all port */
 	for (port_id = 0; port_id < max_port_num; port_id++) {
 		mac_cb = dsaf_dev->mac_cb[port_id];
@@ -1074,6 +1100,7 @@ int hns_mac_init(struct dsaf_device *dsaf_dev)
 		ret = hns_mac_get_cfg(dsaf_dev, mac_cb);
 		if (ret)
 			return ret;
+
 		ret = hns_mac_init_ex(mac_cb);
 		if (ret)
 			return ret;
-- 
1.9.1

[PATCH net v3 3/3] net: hns: fixed bug that skb used after kfree

[Yankejian]

From: lipeng <lipeng321@huawei.com>

There is KASAN warning which turn out it's a skb used after free:

    BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x62c/0x940...
    [17659.112635]      alloc_debug_processing+0x18c/0x1a0
    [17659.117208]      __slab_alloc+0x52c/0x560
    [17659.120909]      kmem_cache_alloc_node+0xac/0x2c0
    [17659.125309]      __alloc_skb+0x6c/0x260
    [17659.128837]      tcp_send_ack+0x8c/0x280
    [17659.132449]      __tcp_ack_snd_check+0x9c/0xf0
    [17659.136587]      tcp_rcv_established+0x5a4/0xa70
    [17659.140899]      tcp_v4_do_rcv+0x27c/0x620
    [17659.144687]      tcp_prequeue_process+0x108/0x170
    [17659.149085]      tcp_recvmsg+0x940/0x1020
    [17659.152787]      inet_recvmsg+0x124/0x180
    [17659.156488]      sock_recvmsg+0x64/0x80
    [17659.160012]      SyS_recvfrom+0xd8/0x180
    [17659.163626]      __sys_trace_return+0x0/0x4
    [17659.167506] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=23 cpu=1 pid=13
    [17659.174000]      free_debug_processing+0x1d4/0x2c0
    [17659.178486]      __slab_free+0x240/0x390
    [17659.182100]      kmem_cache_free+0x24c/0x270
    [17659.186062]      kfree_skbmem+0xa0/0xb0
    [17659.189587]      __kfree_skb+0x28/0x40
    [17659.193025]      napi_gro_receive+0x168/0x1c0
    [17659.197074]      hns_nic_rx_up_pro+0x58/0x90
    [17659.201038]      hns_nic_rx_poll_one+0x518/0xbc0
    [17659.205352]      hns_nic_common_poll+0x94/0x140
    [17659.209576]      net_rx_action+0x458/0x5e0
    [17659.213363]      __do_softirq+0x1b8/0x480
    [17659.217062]      run_ksoftirqd+0x64/0x80
    [17659.220679]      smpboot_thread_fn+0x224/0x310
    [17659.224821]      kthread+0x150/0x170
    [17659.228084]      ret_from_fork+0x10/0x40

    BUG: KASAN: use-after-free in hns_nic_net_xmit+0x8c/0xc0...
    [17751.080490]      __slab_alloc+0x52c/0x560
    [17751.084188]      kmem_cache_alloc+0x244/0x280
    [17751.088238]      __build_skb+0x40/0x150
    [17751.091764]      build_skb+0x28/0x100
    [17751.095115]      __alloc_rx_skb+0x94/0x150
    [17751.098900]      __napi_alloc_skb+0x34/0x90
    [17751.102776]      hns_nic_rx_poll_one+0x180/0xbc0
    [17751.107097]      hns_nic_common_poll+0x94/0x140
    [17751.111333]      net_rx_action+0x458/0x5e0
    [17751.115123]      __do_softirq+0x1b8/0x480
    [17751.118823]      run_ksoftirqd+0x64/0x80
    [17751.122437]      smpboot_thread_fn+0x224/0x310
    [17751.126575]      kthread+0x150/0x170
    [17751.129838]      ret_from_fork+0x10/0x40
    [17751.133454] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=19 cpu=7 pid=43
    [17751.139951]      free_debug_processing+0x1d4/0x2c0
    [17751.144436]      __slab_free+0x240/0x390
    [17751.148051]      kmem_cache_free+0x24c/0x270
    [17751.152014]      kfree_skbmem+0xa0/0xb0
    [17751.155543]      __kfree_skb+0x28/0x40
    [17751.159022]      napi_gro_receive+0x168/0x1c0
    [17751.163074]      hns_nic_rx_up_pro+0x58/0x90
    [17751.167041]      hns_nic_rx_poll_one+0x518/0xbc0
    [17751.171358]      hns_nic_common_poll+0x94/0x140
    [17751.175585]      net_rx_action+0x458/0x5e0
    [17751.179373]      __do_softirq+0x1b8/0x480
    [17751.183076]      run_ksoftirqd+0x64/0x80
    [17751.186691]      smpboot_thread_fn+0x224/0x310
    [17751.190826]      kthread+0x150/0x170
    [17751.194093]      ret_from_fork+0x10/0x40

in drivers/net/ethernet/hisilicon/hns/hns_enet.c

    static netdev_tx_t hns_nic_net_xmit(struct sk_buff *skb,
                                        struct net_device *ndev)
    {
        struct hns_nic_priv *priv = netdev_priv(ndev);
        int ret;

        assert(skb->queue_mapping < ndev->ae_handle->q_num);
        ret = hns_nic_net_xmit_hw(ndev, skb,
                                  &tx_ring_data(priv, skb->queue_mapping));
        if (ret == NETDEV_TX_OK) {
                netif_trans_update(ndev);
                ndev->stats.tx_bytes += skb->len;
                ndev->stats.tx_packets++;
        }
         return (netdev_tx_t)ret;
    }

skb maybe freed in hns_nic_net_xmit_hw() and return NETDEV_TX_OK:

    out_err_tx_ok:

        dev_kfree_skb_any(skb);
        return NETDEV_TX_OK;

This patch fix this bug.

Reported-by: Jun He <hjat2005@huawei.com>
Signed-off-by: lipeng <lipeng321@huawei.com>
Reviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c | 22 ++++++++++------------
 drivers/net/ethernet/hisilicon/hns/hns_enet.h |  6 +++---
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index fca37e2..1e04df6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -300,9 +300,9 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv,
 			     mtu);
 }
 
-int hns_nic_net_xmit_hw(struct net_device *ndev,
-			struct sk_buff *skb,
-			struct hns_nic_ring_data *ring_data)
+netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
+				struct sk_buff *skb,
+				struct hns_nic_ring_data *ring_data)
 {
 	struct hns_nic_priv *priv = netdev_priv(ndev);
 	struct hnae_ring *ring = ring_data->ring;
@@ -361,6 +361,10 @@ int hns_nic_net_xmit_hw(struct net_device *ndev,
 	dev_queue = netdev_get_tx_queue(ndev, skb->queue_mapping);
 	netdev_tx_sent_queue(dev_queue, skb->len);
 
+	netif_trans_update(ndev);
+	ndev->stats.tx_bytes += skb->len;
+	ndev->stats.tx_packets++;
+
 	wmb(); /* commit all data before submit */
 	assert(skb->queue_mapping < priv->ae_handle->q_num);
 	hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
@@ -1474,17 +1478,11 @@ static netdev_tx_t hns_nic_net_xmit(struct sk_buff *skb,
 				    struct net_device *ndev)
 {
 	struct hns_nic_priv *priv = netdev_priv(ndev);
-	int ret;
 
 	assert(skb->queue_mapping < ndev->ae_handle->q_num);
-	ret = hns_nic_net_xmit_hw(ndev, skb,
-				  &tx_ring_data(priv, skb->queue_mapping));
-	if (ret == NETDEV_TX_OK) {
-		netif_trans_update(ndev);
-		ndev->stats.tx_bytes += skb->len;
-		ndev->stats.tx_packets++;
-	}
-	return (netdev_tx_t)ret;
+
+	return hns_nic_net_xmit_hw(ndev, skb,
+				   &tx_ring_data(priv, skb->queue_mapping));
 }
 
 static int hns_nic_change_mtu(struct net_device *ndev, int new_mtu)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.h b/drivers/net/ethernet/hisilicon/hns/hns_enet.h
index 5b412de..7bc6a6e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.h
@@ -91,8 +91,8 @@ struct hns_nic_priv {
 void hns_nic_net_reset(struct net_device *ndev);
 void hns_nic_net_reinit(struct net_device *netdev);
 int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h);
-int hns_nic_net_xmit_hw(struct net_device *ndev,
-			struct sk_buff *skb,
-			struct hns_nic_ring_data *ring_data);
+netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
+				struct sk_buff *skb,
+				struct hns_nic_ring_data *ring_data);
 
 #endif	/**__HNS_ENET_H */
-- 
1.9.1

Re: [PATCH net v2 0/3] net: hns: bug fix for HNS driver

[David Miller]

From: Yankejian <yankejian@huawei.com>
Date: Fri, 21 Apr 2017 15:44:41 +0800

> From: lipeng <lipeng321@huawei.com>
> 
> This series adds support defered probe when mdio or mbigen module
> insmod behind HNS driver, and fixes a bug that a skb has been
> freed, but it may be still used in driver.
> 
> change log:
> V1 -> V2:
> 1. Return appropriate errno in hns_mac_register_phy;

At a minimum you're going to have to expand your commit message in
patch #1 so that it has more detail and explains the situation better.

Re: [PATCH net v2 0/3] net: hns: bug fix for HNS driver

[lipeng (Y)]

On 2017/4/25 0:24, David Miller wrote:
> From: Yankejian <yankejian@huawei.com>
> Date: Fri, 21 Apr 2017 15:44:41 +0800
>
>> From: lipeng <lipeng321@huawei.com>
>>
>> This series adds support defered probe when mdio or mbigen module
>> insmod behind HNS driver, and fixes a bug that a skb has been
>> freed, but it may be still used in driver.
>>
>> change log:
>> V1 -> V2:
>> 1. Return appropriate errno in hns_mac_register_phy;
> At a minimum you're going to have to expand your commit message in
> patch #1 so that it has more detail and explains the situation better.
> .
OK, will add more detail and explains for #1 patch.

thanks