diff options
| author | Zoltan Kiss <zoltan.kiss@citrix.com> | 2014-07-18 19:08:03 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-07-28 08:08:26 -0700 |
| commit | 50b771050668d2df87f9f5488d860e9696a0a5fc (patch) | |
| tree | 2dbb39984b5287408d9d4944f374c2dc0d9012a3 | |
| parent | f6526b2a7f32c894d55e27d31f4c47396b93be2d (diff) | |
xen-netback: Fix releasing frag_list skbs in error path
[ Upstream commit b42cc6e421e7bf74e545483aa34b99d2a2ca6d3a ]
When the grant operations failed, the skb is freed up eventually, and it tries
to release the frags, if there is any. For the main skb nr_frags is set to 0 to
avoid this, but on the frag_list it iterates through the frags array, and tries
to call put_page on the page pointer which contains garbage at that time.
Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Reported-by: Armin Zentai <armin.zentai@ezit.hu>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/xen-netback/netback.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 9b0f482fc8d0..75b7d1a1adad 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -1498,7 +1498,16 @@ static int xenvif_tx_submit(struct xenvif *vif) /* Check the remap error code. */ if (unlikely(xenvif_tx_check_gop(vif, skb, &gop_map, &gop_copy))) { + /* If there was an error, xenvif_tx_check_gop is + * expected to release all the frags which were mapped, + * so kfree_skb shouldn't do it again + */ skb_shinfo(skb)->nr_frags = 0; + if (skb_has_frag_list(skb)) { + struct sk_buff *nskb = + skb_shinfo(skb)->frag_list; + skb_shinfo(nskb)->nr_frags = 0; + } kfree_skb(skb); continue; } |