Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3410f0f authored by Ross Lagerwall's avatar Ross Lagerwall Committed by Greg Kroah-Hartman
Browse files

xen/netback: Reset nr_frags before freeing skb 



[ Upstream commit 3a0233ddec554b886298de2428edb5c50a20e694 ]

At this point nr_frags has been incremented but the frag does not yet
have a page assigned so freeing the skb results in a crash. Reset
nr_frags before freeing the skb to prevent this.

Signed-off-by: default avatarRoss Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cc4ff0f4

drivers/net/xen-netback/netback.c

+2 −0
Original line number Diff line number Diff line
@@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, 
			skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;

			nskb = xenvif_alloc_skb(0);

			if (unlikely(nskb == NULL)) {

				skb_shinfo(skb)->nr_frags = 0;

				kfree_skb(skb);

				xenvif_tx_err(queue, &txreq, extra_count, idx);

				if (net_ratelimit())
@@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, 


			if (xenvif_set_skb_gso(queue->vif, skb, gso)) {

				/* Failure in xenvif_set_skb_gso is fatal. */

				skb_shinfo(skb)->nr_frags = 0;

				kfree_skb(skb);

				kfree_skb(nskb);

				break;