From patchwork Fri Jul 18 18:08:03 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zoltan Kiss X-Patchwork-Id: 371676 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 81FBB14013B for ; Sat, 19 Jul 2014 04:09:30 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1422908AbaGRSJF (ORCPT ); Fri, 18 Jul 2014 14:09:05 -0400 Received: from smtp.citrix.com ([66.165.176.89]:16605 "EHLO SMTP.CITRIX.COM" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1422809AbaGRSIT (ORCPT ); Fri, 18 Jul 2014 14:08:19 -0400 X-IronPort-AV: E=Sophos;i="5.01,686,1400025600"; d="scan'208";a="153763638" Received: from accessns.citrite.net (HELO FTLPEX01CL03.citrite.net) ([10.9.154.239]) by FTLPIPO01.CITRIX.COM with ESMTP; 18 Jul 2014 18:08:19 +0000 Received: from mrteufel.uk.xensource.com (10.80.2.133) by FTLPEX01CL03.citrite.net (10.13.107.80) with Microsoft SMTP Server id 14.3.181.6; Fri, 18 Jul 2014 14:08:18 -0400 From: Zoltan Kiss To: Wei Liu , Ian Campbell CC: Zoltan Kiss , , , Subject: [PATCH net 2/4 v2] xen-netback: Fix releasing frag_list skbs in error path Date: Fri, 18 Jul 2014 19:08:03 +0100 Message-ID: <1405706885-16763-3-git-send-email-zoltan.kiss@citrix.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1405706885-16763-1-git-send-email-zoltan.kiss@citrix.com> References: <1405706885-16763-1-git-send-email-zoltan.kiss@citrix.com> MIME-Version: 1.0 X-Originating-IP: [10.80.2.133] X-DLP: MIA1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When the grant operations failed, the skb is freed up eventually, and it tries to release the frags, if there is any. For the main skb nr_frags is set to 0 to avoid this, but on the frag_list it iterates through the frags array, and tries to call put_page on the page pointer which contains garbage at that time. Signed-off-by: Zoltan Kiss Reported-by: Armin Zentai Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: xen-devel@lists.xenproject.org --- v2: adding comment -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index a773f20..8cbf60d 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -1521,7 +1521,16 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) /* Check the remap error code. */ if (unlikely(xenvif_tx_check_gop(queue, skb, &gop_map, &gop_copy))) { + /* If there was an error, xenvif_tx_check_gop is + * expected to release all the frags which were mapped, + * so kfree_skb shouldn't do it again + */ skb_shinfo(skb)->nr_frags = 0; + if (skb_has_frag_list(skb)) { + struct sk_buff *nskb = + skb_shinfo(skb)->frag_list; + skb_shinfo(nskb)->nr_frags = 0; + } kfree_skb(skb); continue; }