Re: [PATCH] net: korina: remove busy skb free

["Vincent Stehlé" <vincent.stehle@laposte.net>]

On Mon, Dec 14, 2020 at 01:08:32PM -0800, Jakub Kicinski wrote:
> On Mon, 14 Dec 2020 11:03:12 +0100 Julian Wiedmann wrote:
> > > diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
> > > index bf48f0ded9c7d..9d84191de6824 100644
> > > --- a/drivers/net/ethernet/korina.c
> > > +++ b/drivers/net/ethernet/korina.c
> > > @@ -216,7 +216,6 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
> > >  			netif_stop_queue(dev);
> > >  		else {
> > >  			dev->stats.tx_dropped++;
> > > -			dev_kfree_skb_any(skb);
> > >  			spin_unlock_irqrestore(&lp->lock, flags);
> > >  
> > >  			return NETDEV_TX_BUSY;
> > >   
> > 
> > As this skb is returned to the stack (and not dropped), the tx_dropped
> > statistics increment looks bogus too.
> 
> Since this is clearly an ugly use after free, and nobody complained we
> can assume that the driver correctly stops its TX queue ahead of time.
> So perhaps we can change the return value to NETDEV_TX_OK instead.

Hi Jakub,

Thanks for the review.

Ok, if this is the preferred fix I will respin the patch this way.

Best regards,
Vincent.