net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw()
authorLiubin Shu <shuliubin@huawei.com>
Thu, 4 Apr 2019 08:46:42 +0000 (16:46 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 May 2019 05:22:53 +0000 (07:22 +0200)
commitf59129993a5300dce02bea7c3dc77b2ee3fb101c
tree8b2260c22ba2eeb48a31b56df669b0aace60b01a
parent26ac3d804822b757a6a4f73c0497bc9404f9a8e1
net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw()

[ Upstream commit 3a39a12ad364a9acd1038ba8da67cd8430f30de4 ]

This patch is trying to fix the issue due to:
[27237.844750] BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x708/0xa18[hns_enet_drv]

After hnae_queue_xmit() in hns_nic_net_xmit_hw(), can be
interrupted by interruptions, and than call hns_nic_tx_poll_one()
to handle the new packets, and free the skb. So, when turn back to
hns_nic_net_xmit_hw(), calling skb->len will cause use-after-free.

This patch update tx ring statistics in hns_nic_tx_poll_one() to
fix the bug.

Signed-off-by: Liubin Shu <shuliubin@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org>
drivers/net/ethernet/hisilicon/hns/hns_enet.c