| From | Kamal Mostafa <> | Subject | [PATCH 3.8 162/166] virtio_net: don't leak memory or block when too many frags | Date | Wed, 15 Jan 2014 13:52:56 -0800 |
| |
3.8.13.16 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Michael S. Tsirkin" <mst@redhat.com>
We leak an skb when there are too many frags, we also stop processing the packet in the middle, the result is almost sure to be loss of networking.
Reported-by: Michael Dalton <mwdalton@google.com> Acked-by: Michael Dalton <mwdalton@google.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- drivers/net/virtio_net.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 840cf2f..8f009899 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -341,7 +341,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, if (i >= MAX_SKB_FRAGS) { pr_debug("%s: packet too long\n", skb->dev->name); skb->dev->stats.rx_length_errors++; - return NULL; + goto err_frags; } page = virtqueue_get_buf(rq->vq, &len); if (!page) { @@ -362,6 +362,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, err_skb: give_pages(rq, page); while (--num_buf) { +err_frags: buf = virtqueue_get_buf(rq->vq, &len); if (unlikely(!buf)) { pr_debug("%s: rx error: %d buffers missing\n", -- 1.8.3.2
|