Re: [PATCH net 2/3] net: hns3: fix a use after free problem in hns3_nic_maybe_stop_tx()

[Yunsheng Lin]

On 2019/12/3 11:28, David Miller wrote:
> From: Huazhong Tan <tanhuazhong@xxxxxxxxxx>
> Date: Tue, 3 Dec 2019 11:08:54 +0800
> 
>> From: Yunsheng Lin <linyunsheng@xxxxxxxxxx>
>>
>> Currently, hns3_nic_maybe_stop_tx() uses skb_copy() to linearize a
>> SKB if the BD num required by the SKB does not meet the hardware
>> limitation, and it linearizes the SKB by allocating a new SKB and
>> freeing the old SKB, if hns3_nic_maybe_stop_tx() returns -EBUSY,
>> the sch_direct_xmit() still hold reference to old SKB and try to
>> retransmit the old SKB when dev_hard_start_xmit() return TX_BUSY,
>> which may cause use after freed problem.
>>
>> This patch fixes it by using __skb_linearize() to linearize the
>> SKB in hns3_nic_maybe_stop_tx().
>>
>> Fixes: 51e8439f3496 ("net: hns3: add 8 BD limit for tx flow")
>> Signed-off-by: Yunsheng Lin <linyunsheng@xxxxxxxxxx>
>> Signed-off-by: Huazhong Tan <tanhuazhong@xxxxxxxxxx>
> 
> That's not what I see.
> 
> You're freeing the SKB in the caller of hns3_nic_maybe_stop_tx()
> in the -ENOMEM case, not the generic qdisc code.
> 
> Standing practice is to always return NETIF_TX_OK in this case
> and just pretend the frame was sent.
> 
> Grep for __skb_linearize use throughout various drivers to see
> what I mean.  i40e is just one of several examples.

1. When skb_copy()/__skb_linearize()  returns failure, the
hns3_nic_maybe_stop_tx() does return -ENOMEM, and hns3_nic_net_xmit()
does free the skb before returning NETIF_TX_OK, which pretens the frame
was sent.

2. When skb_copy() returns success, the hns3_nic_maybe_stop_tx()
returns -EBUSY when there are not no enough space in the ring to
send the skb to hardware, and hns3_nic_net_xmit() will return
NETDEV_TX_BUSY to the upper layer, the upper layer will resend the old
skb later when driver wakes up the queue, but the old skb has been freed
by the hns3_nic_maybe_stop_tx(). Because when using the skb_copy() to
linearize a skb, it will return a new linearized skb, and the old skb is
freed, the upper layer does not have a reference to the new skb and resend
using the old skb, which casues a use after freed problem.

This patch is trying to fixes the case 2.

Maybe I should mention why hns3_nic_maybe_stop_tx() returns -EBUSY to
better describe the problem?


> 
> 
> .
>