* [PATCH net] net: dsa: skb_put_padto() already frees nskb
@ 2017-08-21 19:41 Florian Fainelli
2017-08-22 18:27 ` David Miller
0 siblings, 1 reply; 7+ messages in thread
From: Florian Fainelli @ 2017-08-21 19:41 UTC (permalink / raw)
To: netdev; +Cc: davem, andrew, vivien.didtelot, woojung.huh, Florian Fainelli
skb_put_padto() already frees the passed sk_buff reference upon error,
so calling kfree_skb() on it again is not necessary.
Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
net/dsa/tag_ksz.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index de66ca8e6201..107172c82107 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -60,10 +60,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
skb_transport_header(skb) - skb->head);
skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
- if (skb_put_padto(nskb, nskb->len + padlen)) {
- kfree_skb(nskb);
+ if (skb_put_padto(nskb, nskb->len + padlen))
return NULL;
- }
kfree_skb(skb);
}
--
2.9.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH net] net: dsa: skb_put_padto() already frees nskb
2017-08-21 19:41 [PATCH net] net: dsa: skb_put_padto() already frees nskb Florian Fainelli
@ 2017-08-22 18:27 ` David Miller
0 siblings, 0 replies; 7+ messages in thread
From: David Miller @ 2017-08-22 18:27 UTC (permalink / raw)
To: f.fainelli; +Cc: netdev, andrew, vivien.didtelot, woojung.huh
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Mon, 21 Aug 2017 12:41:31 -0700
> skb_put_padto() already frees the passed sk_buff reference upon error,
> so calling kfree_skb() on it again is not necessary.
>
> Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
>
> Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
I know it seems like a lot of work, but with appropriate wrappers we
can control the freeing that skb_pad() does at the deepest part of
this call chain.
int __skb_pad(struct sk_buff *skb, int pad, bool free_skb_on_err);
static inline int skb_pad(struct sk_buff *skb, int pad)
{
return __skb_pad(skb, pad, true);
}
static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
bool free_skb_on_err)
{
unsigned int size = skb->len;
if (unlikely(size < len)) {
len -= size;
if (__skb_pad(skb, len, free_skb_on_err))
return -ENOMEM;
__skb_put(skb, len);
}
return 0;
}
static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
{
return __skb_put_padto(skb, len, true);
}
And then here in the ksz_xmit() code, invoke __skb_put_padto() with the
boolean set appropriately.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net] net: dsa: skb_put_padto() already frees nskb
@ 2017-08-21 19:41 Florian Fainelli
2017-08-21 19:47 ` Andrew Lunn
2017-08-21 22:15 ` Woojung.Huh
0 siblings, 2 replies; 7+ messages in thread
From: Florian Fainelli @ 2017-08-21 19:41 UTC (permalink / raw)
To: netdev; +Cc: davem, andrew, vivien.didelot, woojung.huh, Florian Fainelli
skb_put_padto() already frees the passed sk_buff reference upon error,
so calling kfree_skb() on it again is not necessary.
Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
net/dsa/tag_ksz.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index de66ca8e6201..107172c82107 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -60,10 +60,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
skb_transport_header(skb) - skb->head);
skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
- if (skb_put_padto(nskb, nskb->len + padlen)) {
- kfree_skb(nskb);
+ if (skb_put_padto(nskb, nskb->len + padlen))
return NULL;
- }
kfree_skb(skb);
}
--
2.9.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH net] net: dsa: skb_put_padto() already frees nskb
2017-08-21 19:41 Florian Fainelli
@ 2017-08-21 19:47 ` Andrew Lunn
2017-08-21 22:15 ` Woojung.Huh
1 sibling, 0 replies; 7+ messages in thread
From: Andrew Lunn @ 2017-08-21 19:47 UTC (permalink / raw)
To: Florian Fainelli; +Cc: netdev, davem, vivien.didelot, woojung.huh
On Mon, Aug 21, 2017 at 12:41:43PM -0700, Florian Fainelli wrote:
> skb_put_padto() already frees the passed sk_buff reference upon error,
> so calling kfree_skb() on it again is not necessary.
>
> Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
>
> Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply [flat|nested] 7+ messages in thread* RE: [PATCH net] net: dsa: skb_put_padto() already frees nskb
2017-08-21 19:41 Florian Fainelli
2017-08-21 19:47 ` Andrew Lunn
@ 2017-08-21 22:15 ` Woojung.Huh
2017-08-21 22:24 ` Florian Fainelli
1 sibling, 1 reply; 7+ messages in thread
From: Woojung.Huh @ 2017-08-21 22:15 UTC (permalink / raw)
To: f.fainelli, netdev; +Cc: davem, andrew, vivien.didelot
Florian,
> -----Original Message-----
> From: Florian Fainelli [mailto:f.fainelli@gmail.com]
> Sent: Monday, August 21, 2017 3:42 PM
> To: netdev@vger.kernel.org
> Cc: davem@davemloft.net; andrew@lunn.ch;
> vivien.didelot@savoirfairelinux.com; Woojung Huh - C21699; Florian Fainelli
> Subject: [PATCH net] net: dsa: skb_put_padto() already frees nskb
>
> skb_put_padto() already frees the passed sk_buff reference upon error,
> so calling kfree_skb() on it again is not necessary.
>
> Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
>
> Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
> ---
> net/dsa/tag_ksz.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
> index de66ca8e6201..107172c82107 100644
> --- a/net/dsa/tag_ksz.c
> +++ b/net/dsa/tag_ksz.c
> @@ -60,10 +60,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb,
> struct net_device *dev)
> skb_transport_header(skb) - skb-
> >head);
> skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
>
> - if (skb_put_padto(nskb, nskb->len + padlen)) {
> - kfree_skb(nskb);
> + if (skb_put_padto(nskb, nskb->len + padlen))
> return NULL;
> - }
>
> kfree_skb(skb);
> }
> --
Because skb_put_padto() frees skb when it fails, below lines in e71cb9e00922
("net: dsa: ksz: fix skb freeing") will be an issue to.
if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
+ if (skb_put_padto(skb, skb->len + padlen))
+ return NULL;
+
When it fails skb will be freed twice in skb_put_padto() and
caller of dsa_slave_xmit().
Woojung
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH net] net: dsa: skb_put_padto() already frees nskb
2017-08-21 22:15 ` Woojung.Huh
@ 2017-08-21 22:24 ` Florian Fainelli
2017-08-22 18:01 ` Woojung.Huh
0 siblings, 1 reply; 7+ messages in thread
From: Florian Fainelli @ 2017-08-21 22:24 UTC (permalink / raw)
To: Woojung.Huh, netdev; +Cc: davem, andrew, vivien.didelot
On 08/21/2017 03:15 PM, Woojung.Huh@microchip.com wrote:
> Florian,
>
>> -----Original Message-----
>> From: Florian Fainelli [mailto:f.fainelli@gmail.com]
>> Sent: Monday, August 21, 2017 3:42 PM
>> To: netdev@vger.kernel.org
>> Cc: davem@davemloft.net; andrew@lunn.ch;
>> vivien.didelot@savoirfairelinux.com; Woojung Huh - C21699; Florian Fainelli
>> Subject: [PATCH net] net: dsa: skb_put_padto() already frees nskb
>>
>> skb_put_padto() already frees the passed sk_buff reference upon error,
>> so calling kfree_skb() on it again is not necessary.
>>
>> Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
>>
>> Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
>> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
>> ---
>> net/dsa/tag_ksz.c | 4 +---
>> 1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
>> index de66ca8e6201..107172c82107 100644
>> --- a/net/dsa/tag_ksz.c
>> +++ b/net/dsa/tag_ksz.c
>> @@ -60,10 +60,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb,
>> struct net_device *dev)
>> skb_transport_header(skb) - skb-
>>> head);
>> skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
>>
>> - if (skb_put_padto(nskb, nskb->len + padlen)) {
>> - kfree_skb(nskb);
>> + if (skb_put_padto(nskb, nskb->len + padlen))
>> return NULL;
>> - }
>>
>> kfree_skb(skb);
>> }
>> --
>
> Because skb_put_padto() frees skb when it fails, below lines in e71cb9e00922
> ("net: dsa: ksz: fix skb freeing") will be an issue to.
>
> if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
> + if (skb_put_padto(skb, skb->len + padlen))
> + return NULL;
> +
>
> When it fails skb will be freed twice in skb_put_padto() and
> caller of dsa_slave_xmit().
You are right, I am not sure what is the best way to fix tag_ksz.c other
than somehow open coding skb_put_padto() minus the freeing on error part?
--
Florian
^ permalink raw reply [flat|nested] 7+ messages in thread* RE: [PATCH net] net: dsa: skb_put_padto() already frees nskb
2017-08-21 22:24 ` Florian Fainelli
@ 2017-08-22 18:01 ` Woojung.Huh
0 siblings, 0 replies; 7+ messages in thread
From: Woojung.Huh @ 2017-08-22 18:01 UTC (permalink / raw)
To: f.fainelli, netdev; +Cc: davem, andrew, vivien.didelot
> > Because skb_put_padto() frees skb when it fails, below lines in
> e71cb9e00922
> > ("net: dsa: ksz: fix skb freeing") will be an issue to.
> >
> > if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
> > + if (skb_put_padto(skb, skb->len + padlen))
> > + return NULL;
> > +
> >
> > When it fails skb will be freed twice in skb_put_padto() and
> > caller of dsa_slave_xmit().
>
> You are right, I am not sure what is the best way to fix tag_ksz.c other
> than somehow open coding skb_put_padto() minus the freeing on error part?
Agree. May need to go back to 1st submission without skb_put_padto().
Will check more if any other ideas.
Thanks.
Woojung
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2017-08-22 18:27 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-08-21 19:41 [PATCH net] net: dsa: skb_put_padto() already frees nskb Florian Fainelli
2017-08-22 18:27 ` David Miller
-- strict thread matches above, loose matches on Subject: below --
2017-08-21 19:41 Florian Fainelli
2017-08-21 19:47 ` Andrew Lunn
2017-08-21 22:15 ` Woojung.Huh
2017-08-21 22:24 ` Florian Fainelli
2017-08-22 18:01 ` Woojung.Huh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).