* [PATCH] xen/netback: Reset nr_frags before freeing skb
@ 2019-08-05 15:34 Ross Lagerwall
2019-08-09 1:02 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Ross Lagerwall @ 2019-08-05 15:34 UTC (permalink / raw)
To: netdev; +Cc: xen-devel, David S. Miller, Paul Durrant, Wei Liu, Ross Lagerwall
At this point nr_frags has been incremented but the frag does not yet
have a page assigned so freeing the skb results in a crash. Reset
nr_frags before freeing the skb to prevent this.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
---
drivers/net/xen-netback/netback.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 1d9940d4e8c7..c9262ffeefe4 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
nskb = xenvif_alloc_skb(0);
if (unlikely(nskb == NULL)) {
+ skb_shinfo(skb)->nr_frags = 0;
kfree_skb(skb);
xenvif_tx_err(queue, &txreq, extra_count, idx);
if (net_ratelimit())
@@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
/* Failure in xenvif_set_skb_gso is fatal. */
+ skb_shinfo(skb)->nr_frags = 0;
kfree_skb(skb);
kfree_skb(nskb);
break;
--
2.17.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] xen/netback: Reset nr_frags before freeing skb
2019-08-05 15:34 [PATCH] xen/netback: Reset nr_frags before freeing skb Ross Lagerwall
@ 2019-08-09 1:02 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-08-09 1:02 UTC (permalink / raw)
To: ross.lagerwall; +Cc: netdev, xen-devel, paul.durrant, wei.liu
From: Ross Lagerwall <ross.lagerwall@citrix.com>
Date: Mon, 5 Aug 2019 16:34:34 +0100
> At this point nr_frags has been incremented but the frag does not yet
> have a page assigned so freeing the skb results in a crash. Reset
> nr_frags before freeing the skb to prevent this.
>
> Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-09 1:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-05 15:34 [PATCH] xen/netback: Reset nr_frags before freeing skb Ross Lagerwall
2019-08-09 1:02 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).