Re: [PATCH 1/1] Defer skb allocation for both mergeable buffers and big packets in virtio_net

Shirley Ma
2009-11-20T16:08:54Z

On Fri, 2009-11-20 at 07:19 +0100, Eric Dumazet wrote:
> > +void virtio_free_pages(void *buf)
> > +{
> > + struct page *page = (struct page *)buf;
> > +
> > + while (page) {
> > + __free_pages(page, 0);
> > + page = (struct page *)page->private;
> > + }
> > +}
> > +
>
> Interesting use after free :)

Good catch. This code was run when virtio_net removal. I run many times
of remove virtio_net, and didn't hit any panic :(. Fixed it as below:

void virtio_free_pages(void *buf)
{
struct page *page = (struct page *)buf;
struct page *npage;

while (page) {
npage = page->private;
__free_pages(page, 0);
page = npage;
}
}

Thanks
Shirley