releases/4.14.117/net-hns-fix-kasan-use-after-free-in-hns_nic_net_xmit.patch

   1 From e3130a5eea1224cedd35e6e4efa51654ed0503e5 Mon Sep 17 00:00:00 2001
   2 From: Liubin Shu <shuliubin@huawei.com>
   3 Date: Thu, 4 Apr 2019 16:46:42 +0800
   4 Subject: net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw()
   5
   6 [ Upstream commit 3a39a12ad364a9acd1038ba8da67cd8430f30de4 ]
   7
   8 This patch is trying to fix the issue due to:
   9 [27237.844750] BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x708/0xa18[hns_enet_drv]
  10
  11 After hnae_queue_xmit() in hns_nic_net_xmit_hw(), can be
  12 interrupted by interruptions, and than call hns_nic_tx_poll_one()
  13 to handle the new packets, and free the skb. So, when turn back to
  14 hns_nic_net_xmit_hw(), calling skb->len will cause use-after-free.
  15
  16 This patch update tx ring statistics in hns_nic_tx_poll_one() to
  17 fix the bug.
  18
  19 Signed-off-by: Liubin Shu <shuliubin@huawei.com>
  20 Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
  21 Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
  22 Signed-off-by: Peng Li <lipeng321@huawei.com>
  23 Signed-off-by: David S. Miller <davem@davemloft.net>
  24 Signed-off-by: Sasha Levin <sashal@kernel.org>
  25 ---
  26  drivers/net/ethernet/hisilicon/hns/hns_enet.c | 5 +++--
  27  1 file changed, 3 insertions(+), 2 deletions(-)
  28
  29 diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
  30 index d30c28fba249..15739eae3da1 100644
  31 --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
  32 +++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
  33 @@ -376,8 +376,6 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
  34         wmb(); /* commit all data before submit */
  35         assert(skb->queue_mapping < priv->ae_handle->q_num);
  36         hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
  37 -       ring->stats.tx_pkts++;
  38 -       ring->stats.tx_bytes += skb->len;
  39
  40         return NETDEV_TX_OK;
  41
  42 @@ -1099,6 +1097,9 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
  43                 /* issue prefetch for next Tx descriptor */
  44                 prefetch(&ring->desc_cb[ring->next_to_clean]);
  45         }
  46 +       /* update tx ring statistics. */
  47 +       ring->stats.tx_pkts += pkts;
  48 +       ring->stats.tx_bytes += bytes;
  49
  50         NETIF_TX_UNLOCK(ring);
  51
  52 --
  53 2.20.1
  54