diff options
| author | Liubin Shu <shuliubin@huawei.com> | 2019-04-04 16:46:42 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-04 10:35:42 -0700 |
| commit | 3a39a12ad364a9acd1038ba8da67cd8430f30de4 (patch) | |
| tree | 7a27792a1e704ea5badac7f52540bbe2b8812a64 /drivers/hv | |
| parent | ef0efcd3bd3fd0589732b67fb586ffd3c8705806 (diff) | |
| download | linux-3a39a12ad364a9acd1038ba8da67cd8430f30de4.tar.bz2 | |
net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw()
This patch is trying to fix the issue due to:
[27237.844750] BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x708/0xa18[hns_enet_drv]
After hnae_queue_xmit() in hns_nic_net_xmit_hw(), can be
interrupted by interruptions, and than call hns_nic_tx_poll_one()
to handle the new packets, and free the skb. So, when turn back to
hns_nic_net_xmit_hw(), calling skb->len will cause use-after-free.
This patch update tx ring statistics in hns_nic_tx_poll_one() to
fix the bug.
Signed-off-by: Liubin Shu <shuliubin@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/hv')
0 files changed, 0 insertions, 0 deletions