lkml.org 
[lkml]   [2019]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 82/85] xen/netback: Reset nr_frags before freeing skb
    Date
    From: Ross Lagerwall <ross.lagerwall@citrix.com>

    [ Upstream commit 3a0233ddec554b886298de2428edb5c50a20e694 ]

    At this point nr_frags has been incremented but the frag does not yet
    have a page assigned so freeing the skb results in a crash. Reset
    nr_frags before freeing the skb to prevent this.

    Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/xen-netback/netback.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/drivers/net/xen-netback/netback.c
    +++ b/drivers/net/xen-netback/netback.c
    @@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct
    skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
    nskb = xenvif_alloc_skb(0);
    if (unlikely(nskb == NULL)) {
    + skb_shinfo(skb)->nr_frags = 0;
    kfree_skb(skb);
    xenvif_tx_err(queue, &txreq, extra_count, idx);
    if (net_ratelimit())
    @@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct

    if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
    /* Failure in xenvif_set_skb_gso is fatal. */
    + skb_shinfo(skb)->nr_frags = 0;
    kfree_skb(skb);
    kfree_skb(nskb);
    break;

    \
     
     \ /
      Last update: 2019-08-22 19:56    [W:2.911 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site