Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f483e77 authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Greg Kroah-Hartman
Browse files

virtio_net: check return value of skb_to_sgvec always 



commit e2fcad58fd230f635a74e4e983c6f4ea893642d2 upstream.

Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: default avatarSergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
[natechancellor: backport to 4.4]
Signed-off-by: default avatarNathan Chancellor <natechancellor@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ea63eca9

drivers/net/virtio_net.c

+7 −2
Original line number Original line Diff line number Diff line
@@ -858,7 +858,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) 
	struct virtio_net_hdr_mrg_rxbuf *hdr;

	struct virtio_net_hdr_mrg_rxbuf *hdr;

	const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;

	const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;

	struct virtnet_info *vi = sq->vq->vdev->priv;

	struct virtnet_info *vi = sq->vq->vdev->priv;

	unsigned num_sg;

	int num_sg;

	unsigned hdr_len = vi->hdr_len;

	unsigned hdr_len = vi->hdr_len;

	bool can_push;

	bool can_push;
@@ -911,11 +911,16 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) 
	if (can_push) {

	if (can_push) {

		__skb_push(skb, hdr_len);

		__skb_push(skb, hdr_len);

		num_sg = skb_to_sgvec(skb, sq->sg, 0, skb->len);

		num_sg = skb_to_sgvec(skb, sq->sg, 0, skb->len);

		if (unlikely(num_sg < 0))

			return num_sg;

		/* Pull header back to avoid skew in tx bytes calculations. */

		/* Pull header back to avoid skew in tx bytes calculations. */

		__skb_pull(skb, hdr_len);

		__skb_pull(skb, hdr_len);

	} else {

	} else {

		sg_set_buf(sq->sg, hdr, hdr_len);

		sg_set_buf(sq->sg, hdr, hdr_len);

		num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len) + 1;

		num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len);

		if (unlikely(num_sg < 0))

			return num_sg;

		num_sg++;

	}

	}

	return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC);

	return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC);

}

}