2012-10-24 18:27:07

by Ed L. Cashin

Subject: [PATCH] aoe: avoid using skb member after dev_queue_xmit

After calling dev_queue_xmit it is no longer safe to access the
members of the skb.

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Ed Cashin <[email protected]>
---
drivers/block/aoe/aoenet.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index ae56828..2e47404 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -55,12 +55,14 @@ static int
tx(void) __must_hold(&txlock)
{
struct sk_buff *skb;
+ struct net_device *ifp;

while ((skb = skb_dequeue(&skbtxq))) {
spin_unlock_irq(&txlock);
+ ifp = skb->dev;
if (dev_queue_xmit(skb) == NET_XMIT_DROP && net_ratelimit())
pr_warn("aoe: packet could not be sent on %s. %s\n",
- skb->dev ? skb->dev->name : "netif",
+ ifp ? ifp->name : "netif",
"consider increasing tx_queue_len");
spin_lock_irq(&txlock);
}
--
1.7.1

2012-10-24 22:08:11

by Andrew Morton

Subject: Re: [PATCH] aoe: avoid using skb member after dev_queue_xmit

On Wed, 24 Oct 2012 14:26:13 -0400
Ed Cashin <[email protected]> wrote:

> After calling dev_queue_xmit it is no longer safe to access the
> members of the skb.
>
> Reported-by: Dan Carpenter <[email protected]>

hm, that was clever. How did Dan detect this bug?

> --- a/drivers/block/aoe/aoenet.c
> +++ b/drivers/block/aoe/aoenet.c
> @@ -55,12 +55,14 @@ static int
> tx(void) __must_hold(&txlock)
> {
> struct sk_buff *skb;
> + struct net_device *ifp;
>
> while ((skb = skb_dequeue(&skbtxq))) {
> spin_unlock_irq(&txlock);
> + ifp = skb->dev;
> if (dev_queue_xmit(skb) == NET_XMIT_DROP && net_ratelimit())
> pr_warn("aoe: packet could not be sent on %s. %s\n",
> - skb->dev ? skb->dev->name : "netif",
> + ifp ? ifp->name : "netif",
> "consider increasing tx_queue_len");
> spin_lock_irq(&txlock);
> }

Queued as a fix against the not-yet-upstream
aoe-print-warning-regarding-a-common-reason-for-dropped-transmits.patch,
thanks.

2012-10-25 06:33:38

by Dan Carpenter

Subject: Re: [PATCH] aoe: avoid using skb member after dev_queue_xmit

On Wed, Oct 24, 2012 at 03:08:07PM -0700, Andrew Morton wrote:
> On Wed, 24 Oct 2012 14:26:13 -0400
> Ed Cashin <[email protected]> wrote:
>
> > After calling dev_queue_xmit it is no longer safe to access the
> > members of the skb.
> >
> > Reported-by: Dan Carpenter <[email protected]>
>
> hm, that was clever. How did Dan detect this bug?

It was a Smatch thing, but it wasn't enabled by default. I think I
will enable it. This is the second bug use after dev_queue_xmit()
in two years.

regards,
dan carpenter

2012-10-25 17:36:06

by Ed L. Cashin

Subject: Re: [PATCH] aoe: avoid using skb member after dev_queue_xmit

On Oct 25, 2012, at 2:33 AM, Dan Carpenter wrote:

> On Wed, Oct 24, 2012 at 03:08:07PM -0700, Andrew Morton wrote:
>> On Wed, 24 Oct 2012 14:26:13 -0400
>> Ed Cashin <[email protected]> wrote:
>>
>>> After calling dev_queue_xmit it is no longer safe to access the
>>> members of the skb.
>>>
>>> Reported-by: Dan Carpenter <[email protected]>
>>
>> hm, that was clever. How did Dan detect this bug?
>
> It was a Smatch thing, but it wasn't enabled by default. I think I
> will enable it. This is the second bug use after dev_queue_xmit()
> in two years.

OK, no more procrastinating. I'm using smatch from today forward.

--
Ed Cashin
[email protected]