Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH net-next v2 4/5] r8152: support skb_add_rx_frag
To:     Hayes Wang <hayeswang@realtek.com>, netdev@vger.kernel.org
Cc:     nic_swsd@realtek.com, linux-kernel@vger.kernel.org,
        linux-usb@vger.kernel.org
References: <1394712342-15778-289-Taiwan-albertk@realtek.com>
 <1394712342-15778-295-albertk@realtek.com>
 <1394712342-15778-299-albertk@realtek.com>
From:   Eric Dumazet <eric.dumazet@gmail.com>
Message-ID: <614e322b-fcca-fd4f-f338-76a7fbf84ad1@gmail.com>
Date:   Fri, 16 Aug 2019 08:42:35 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.2
MIME-Version: 1.0
In-Reply-To: <1394712342-15778-299-albertk@realtek.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 8/13/19 5:42 AM, Hayes Wang wrote:
> Use skb_add_rx_frag() to reduce the memory copy for rx data.
> 
> Use a new list of rx_used to store the rx buffer which couldn't be
> reused yet.
> 
> Besides, the total number of rx buffer may be increased or decreased
> dynamically. And it is limited by RTL8152_MAX_RX_AGG.
> 
> Signed-off-by: Hayes Wang <hayeswang@realtek.com>
>

...

>  			skb->protocol = eth_type_trans(skb, netdev);
>  			rtl_rx_vlan_tag(rx_desc, skb);
>  			if (work_done < budget) {
>  				napi_gro_receive(napi, skb);
>  				work_done++;
>  				stats->rx_packets++;
> -				stats->rx_bytes += pkt_len;
> +				stats->rx_bytes += skb->len;

use-after-free. skb is no longer in your hands after napi_gro_receive()