LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] can: kvaser_usb: Don't free packets when tight on URBs
@ 2014-12-23 15:46 Ahmed S. Darwish
  2014-12-23 15:53 ` [PATCH] can: kvaser_usb: Add support for the Usbcan-II family Ahmed S. Darwish
                   ` (7 more replies)
  0 siblings, 8 replies; 95+ messages in thread
From: Ahmed S. Darwish @ 2014-12-23 15:46 UTC (permalink / raw)
  To: Olivier Sobrie, Oliver Hartkopp, Wolfgang Grandegger, Marc Kleine-Budde
  Cc: David S. Miller, Paul Gortmaker, Linux-CAN, netdev, LKML

From: Ahmed S. Darwish <ahmed.darwish@valeo.com>

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in high frequency caused seemingly-random panics in the
kernel.

On further inspection, it seems the driver erroneously freed the
to-be-transmitted packet upon getting tight on URBs and returning
NETDEV_TX_BUSY, leading to invalid memory writes and double frees
at a later point in time.

Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
---
 drivers/net/can/usb/kvaser_usb.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

 (Generated over 3.19.0-rc1)

diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 541fb7a..34c35d8 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -1286,6 +1286,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
 	struct kvaser_msg *msg;
 	int i, err;
 	int ret = NETDEV_TX_OK;
+	bool kfree_skb_on_error = true;
 
 	if (can_dropped_invalid_skb(netdev, skb))
 		return NETDEV_TX_OK;
@@ -1336,6 +1337,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
 
 	if (!context) {
 		netdev_warn(netdev, "cannot find free context\n");
+		kfree_skb_on_error = false;
 		ret =  NETDEV_TX_BUSY;
 		goto releasebuf;
 	}
@@ -1364,8 +1366,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
 	if (unlikely(err)) {
 		can_free_echo_skb(netdev, context->echo_index);
 
-		skb = NULL; /* set to NULL to avoid double free in
-			     * dev_kfree_skb(skb) */
+		kfree_skb_on_error = false;
 
 		atomic_dec(&priv->active_tx_urbs);
 		usb_unanchor_urb(urb);
@@ -1389,7 +1390,8 @@ releasebuf:
 nobufmem:
 	usb_free_urb(urb);
 nourbmem:
-	dev_kfree_skb(skb);
+	if (kfree_skb_on_error)
+		dev_kfree_skb(skb);
 	return ret;
 }


^ permalink raw reply	[flat|nested] 95+ messages in thread

end of thread, other threads:[~2015-01-26 10:56 UTC | newest]

Thread overview: 95+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-12-23 15:46 [PATCH] can: kvaser_usb: Don't free packets when tight on URBs Ahmed S. Darwish
2014-12-23 15:53 ` [PATCH] can: kvaser_usb: Add support for the Usbcan-II family Ahmed S. Darwish
2014-12-24 12:36   ` Olivier Sobrie
2014-12-24 15:04     ` Ahmed S. Darwish
2014-12-28 21:51       ` Olivier Sobrie
2014-12-30 15:33         ` Ahmed S. Darwish
2014-12-31 12:13           ` Olivier Sobrie
2014-12-24 12:31 ` [PATCH] can: kvaser_usb: Don't free packets when tight on URBs Olivier Sobrie
2014-12-24 15:52   ` Ahmed S. Darwish
2014-12-24 23:56 ` [PATCH v2 1/4] " Ahmed S. Darwish
2014-12-24 23:59   ` [PATCH v2 2/4] can: kvaser_usb: Reset all URB tx contexts upon channel close Ahmed S. Darwish
2014-12-25  0:02     ` [PATCH v2 3/4] can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels Ahmed S. Darwish
2014-12-25  0:04       ` [PATCH v2 4/4] can: kvaser_usb: Add support for the Usbcan-II family Ahmed S. Darwish
2014-12-28 21:54       ` [PATCH v2 3/4] can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels Olivier Sobrie
2014-12-25  2:50   ` [PATCH v2 1/4] can: kvaser_usb: Don't free packets when tight on URBs Greg KH
2014-12-25  9:38     ` Ahmed S. Darwish
2014-12-28 21:52   ` Olivier Sobrie
2015-01-01 21:59 ` [PATCH] " Stephen Hemminger
2015-01-03 14:34   ` Ahmed S. Darwish
2015-01-05 17:49 ` [PATCH v3 1/4] " Ahmed S. Darwish
2015-01-05 17:52   ` [PATCH v3 2/4] can: kvaser_usb: Reset all URB tx contexts upon channel close Ahmed S. Darwish
2015-01-05 17:57     ` [PATCH v3 3/4] can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels Ahmed S. Darwish
2015-01-05 18:31       ` [PATCH v3 4/4] can: kvaser_usb: Add support for the Usbcan-II family Ahmed S. Darwish
2015-01-08 11:53         ` Marc Kleine-Budde
2015-01-08 15:19           ` Ahmed S. Darwish
2015-01-12 11:51             ` Marc Kleine-Budde
2015-01-12 12:26               ` Ahmed S. Darwish
2015-01-12 12:34                 ` Marc Kleine-Budde
2015-01-09  3:06           ` Ahmed S. Darwish
2015-01-09 14:05             ` Marc Kleine-Budde
2015-01-08  9:59   ` [PATCH v3 1/4] can: kvaser_usb: Don't free packets when tight on URBs Marc Kleine-Budde
2015-01-11 20:05 ` [PATCH v4 00/04] can: Introduce support for Kvaser USBCAN-II devices Ahmed S. Darwish
2015-01-11 20:11   ` [PATCH v4 01/04] can: kvaser_usb: Don't dereference skb after a netif_rx() devices Ahmed S. Darwish
2015-01-11 20:15     ` [PATCH v4 2/4] can: kvaser_usb: Update error counters before exiting on OOM Ahmed S. Darwish
2015-01-11 20:36       ` [PATCH v4 3/4] can: kvaser_usb: Add support for the Usbcan-II family Ahmed S. Darwish
2015-01-11 20:45         ` [PATCH v4 4/4] can: kvaser_usb: Retry first bulk transfer on -ETIMEDOUT Ahmed S. Darwish
2015-01-11 20:51           ` Marc Kleine-Budde
2015-01-12 10:14             ` Ahmed S. Darwish
2015-01-12 10:25               ` Marc Kleine-Budde
2015-01-12 13:33               ` Olivier Sobrie
2015-01-12 13:50                 ` Ahmed S. Darwish
2015-01-12 11:20         ` [PATCH v4 3/4] can: kvaser_usb: Add support for the Usbcan-II family Ahmed S. Darwish
2015-01-12 11:43         ` Marc Kleine-Budde
2015-01-12 12:07           ` Ahmed S. Darwish
2015-01-12 12:36             ` Ahmed S. Darwish
2015-01-12 13:53         ` Olivier Sobrie
2015-01-18 20:12           ` Ahmed S. Darwish
2015-01-18 20:13             ` Marc Kleine-Budde
2015-01-12 11:09       ` [PATCH v4 2/4] can: kvaser_usb: Update error counters before exiting on OOM Marc Kleine-Budde
2015-01-12 20:36         ` Ahmed S. Darwish
2015-01-16 14:39           ` Marc Kleine-Budde
2015-01-11 20:49     ` [PATCH v4 01/04] can: kvaser_usb: Don't dereference skb after a netif_rx() Ahmed S. Darwish
2015-01-12 11:05       ` Marc Kleine-Budde
2015-01-20 21:44 ` [PATCH v5 1/5] can: kvaser_usb: Update net interface state before exiting on OOM Ahmed S. Darwish
2015-01-20 21:45   ` [PATCH v5 2/5] can: kvaser_usb: Consolidate and unify state change handling Ahmed S. Darwish
2015-01-20 21:47     ` [PATCH v5 3/5] can: kvaser_usb: Fix state handling upon BUS_ERROR events Ahmed S. Darwish
2015-01-20 21:48       ` [PATCH v5 4/5] can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT Ahmed S. Darwish
2015-01-20 21:50         ` [PATCH v5 5/5] can: kvaser_usb: Add support for the USBcan-II family Ahmed S. Darwish
2015-01-21 12:24         ` [PATCH v5 4/5] can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT Sergei Shtylyov
2015-01-25 11:59           ` Ahmed S. Darwish
2015-01-21 10:33     ` [PATCH v5 2/5] can: kvaser_usb: Consolidate and unify state change handling Andri Yngvason
2015-01-21 10:44       ` Marc Kleine-Budde
2015-01-21 11:00         ` Andri Yngvason
2015-01-21 11:53       ` Wolfgang Grandegger
2015-01-21 14:43         ` Ahmed S. Darwish
2015-01-21 15:00           ` Andri Yngvason
2015-01-21 15:36             ` Ahmed S. Darwish
2015-01-21 16:13               ` Wolfgang Grandegger
2015-01-23  6:07                 ` Ahmed S. Darwish
2015-01-23 10:32                   ` Andri Yngvason
2015-01-25  2:43                     ` Ahmed S. Darwish
2015-01-26 10:21                       ` Andri Yngvason
2015-01-21 16:37               ` Andri Yngvason
2015-01-21 16:20     ` Andri Yngvason
2015-01-21 22:59       ` Marc Kleine-Budde
2015-01-22 10:14         ` Andri Yngvason
2015-01-25  2:49           ` Ahmed S. Darwish
2015-01-25  3:21       ` Ahmed S. Darwish
2015-01-26  5:17 ` [PATCH v6 0/7] can: kvaser_usb: Leaf bugfixes and USBCan-II support Ahmed S. Darwish
2015-01-26  5:20   ` [PATCH v6 1/7] can: kvaser_usb: Do not sleep in atomic context Ahmed S. Darwish
2015-01-26  5:22     ` [PATCH v6 2/7] can: kvaser_usb: Send correct context to URB completion Ahmed S. Darwish
2015-01-26  5:24       ` [PATCH v6 3/7] can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT Ahmed S. Darwish
2015-01-26  5:25         ` [PATCH v6 4/7] can: kvaser_usb: Fix state handling upon BUS_ERROR events Ahmed S. Darwish
2015-01-26  5:27           ` [PATCH v6 5/7] can: kvaser_usb: Update interface state before exiting on OOM Ahmed S. Darwish
2015-01-26  5:29             ` [PATCH v6 6/7] can: kvaser_usb: Consolidate and unify state change handling Ahmed S. Darwish
2015-01-26  5:33               ` [PATCH v6 7/7] can: kvaser_usb: Add support for the USBcan-II family Ahmed S. Darwish
2015-01-26 10:34                 ` Andri Yngvason
2015-01-26 10:26               ` [PATCH v6 6/7] can: kvaser_usb: Consolidate and unify state change handling Andri Yngvason
2015-01-26 10:28             ` [PATCH v6 5/7] can: kvaser_usb: Update interface state before exiting on OOM Andri Yngvason
2015-01-26 10:50               ` Marc Kleine-Budde
2015-01-26 10:52                 ` Andri Yngvason
2015-01-26 10:53                   ` Marc Kleine-Budde
2015-01-26  9:55   ` [PATCH v6 0/7] can: kvaser_usb: Leaf bugfixes and USBCan-II support Marc Kleine-Budde
2015-01-26 10:07   ` Marc Kleine-Budde
2015-01-26 10:56     ` Marc Kleine-Budde

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox