* [PATCH] xen/netback: Reset nr_frags before freeing skb
@ 2019-08-05 15:34 Ross Lagerwall
2019-08-09 1:02 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Ross Lagerwall @ 2019-08-05 15:34 UTC (permalink / raw)
To: netdev; +Cc: xen-devel, David S. Miller, Paul Durrant, Wei Liu, Ross Lagerwall
At this point nr_frags has been incremented but the frag does not yet
have a page assigned so freeing the skb results in a crash. Reset
nr_frags before freeing the skb to prevent this.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
---
drivers/net/xen-netback/netback.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 1d9940d4e8c7..c9262ffeefe4 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
nskb = xenvif_alloc_skb(0);
if (unlikely(nskb == NULL)) {
+ skb_shinfo(skb)->nr_frags = 0;
kfree_skb(skb);
xenvif_tx_err(queue, &txreq, extra_count, idx);
if (net_ratelimit())
@@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
/* Failure in xenvif_set_skb_gso is fatal. */
+ skb_shinfo(skb)->nr_frags = 0;
kfree_skb(skb);
kfree_skb(nskb);
break;
--
2.17.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-09 1:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-05 15:34 [PATCH] xen/netback: Reset nr_frags before freeing skb Ross Lagerwall
2019-08-09 1:02 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).