Messages in this thread | | | Subject | Re: [PATCH 1/1] Defer skb allocation for both mergeable buffers and big packets in virtio_net | From | Shirley Ma <> | Date | Fri, 20 Nov 2009 08:08:52 -0800 |
| |
On Fri, 2009-11-20 at 07:19 +0100, Eric Dumazet wrote: > > +void virtio_free_pages(void *buf) > > +{ > > + struct page *page = (struct page *)buf; > > + > > + while (page) { > > + __free_pages(page, 0); > > + page = (struct page *)page->private; > > + } > > +} > > + > > Interesting use after free :)
Good catch. This code was run when virtio_net removal. I run many times of remove virtio_net, and didn't hit any panic :(. Fixed it as below:
void virtio_free_pages(void *buf) { struct page *page = (struct page *)buf; struct page *npage;
while (page) { npage = page->private; __free_pages(page, 0); page = npage; } }
Thanks Shirley
| |