On Thu, Dec 25, 2014 at 01:56:44AM +0200, Ahmed S. Darwish wrote:
> From: Ahmed S. Darwish <ahmed.darwish@xxxxxxxxx>
>
> Flooding the Kvaser CAN to USB dongle with multiple reads and
> writes in high frequency caused seemingly-random panics in the
> kernel.
>
> On further inspection, it seems the driver erroneously freed the
> to-be-transmitted packet upon getting tight on URBs and returning
> NETDEV_TX_BUSY, leading to invalid memory writes and double frees
> at a later point in time.
>
> Note:
>
> Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
> is a driver bug in and out of itself: it means that our start/stop
> queue flow control is broken.
>
> This patch only fixes the (buggy) error handling code; the root
> cause shall be fixed in a later commit.
>
> Signed-off-by: Ahmed S. Darwish <ahmed.darwish@xxxxxxxxx>
Acked-by: Olivier Sobrie <olivier@xxxxxxxxx>
> ---
> drivers/net/can/usb/kvaser_usb.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> (Marc, Greg, I believe this should also be added to -stable?)
>
> diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
> index 541fb7a..6479a2b 100644
> --- a/drivers/net/can/usb/kvaser_usb.c
> +++ b/drivers/net/can/usb/kvaser_usb.c
> @@ -1294,12 +1294,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
> if (!urb) {
> netdev_err(netdev, "No memory left for URBs\n");
> stats->tx_dropped++;
> - goto nourbmem;
> + dev_kfree_skb(skb);
> + return NETDEV_TX_OK;
> }
>
> buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
> if (!buf) {
> stats->tx_dropped++;
> + dev_kfree_skb(skb);
> goto nobufmem;
> }
>
> @@ -1334,6 +1336,9 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
> }
> }
>
> + /*
> + * This should never happen; it implies a flow control bug.
> + */
> if (!context) {
> netdev_warn(netdev, "cannot find free context\n");
> ret = NETDEV_TX_BUSY;
> @@ -1364,9 +1369,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
> if (unlikely(err)) {
> can_free_echo_skb(netdev, context->echo_index);
>
> - skb = NULL; /* set to NULL to avoid double free in
> - * dev_kfree_skb(skb) */
> -
> atomic_dec(&priv->active_tx_urbs);
> usb_unanchor_urb(urb);
>
> @@ -1388,8 +1390,6 @@ releasebuf:
> kfree(buf);
> nobufmem:
> usb_free_urb(urb);
> -nourbmem:
> - dev_kfree_skb(skb);
> return ret;
> }
>
--
Olivier
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html