lkml.org 
[lkml]   [2014]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.8 162/166] virtio_net: don't leak memory or block when too many frags
    Date
    3.8.13.16 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "Michael S. Tsirkin" <mst@redhat.com>

    We leak an skb when there are too many frags,
    we also stop processing the packet in the middle,
    the result is almost sure to be loss of networking.

    Reported-by: Michael Dalton <mwdalton@google.com>
    Acked-by: Michael Dalton <mwdalton@google.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/net/virtio_net.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
    index 840cf2f..8f009899 100644
    --- a/drivers/net/virtio_net.c
    +++ b/drivers/net/virtio_net.c
    @@ -341,7 +341,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
    if (i >= MAX_SKB_FRAGS) {
    pr_debug("%s: packet too long\n", skb->dev->name);
    skb->dev->stats.rx_length_errors++;
    - return NULL;
    + goto err_frags;
    }
    page = virtqueue_get_buf(rq->vq, &len);
    if (!page) {
    @@ -362,6 +362,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
    err_skb:
    give_pages(rq, page);
    while (--num_buf) {
    +err_frags:
    buf = virtqueue_get_buf(rq->vq, &len);
    if (unlikely(!buf)) {
    pr_debug("%s: rx error: %d buffers missing\n",
    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-01-16 00:01    [W:4.451 / U:1.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site