diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2013-12-26 15:32:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-01-15 15:31:37 -0800 |
| commit | effb6d243d4da7ab063e6c0668a4f6e23cb5adb9 (patch) | |
| tree | 59363b426c09769dc502f71f7cbac7fcb047ec2b | |
| parent | aa016e2d4009621c8d48fecb20ef46a005c75aa8 (diff) | |
virtio_net: don't leak memory or block when too many frags
We leak an skb when there are too many frags,
we also stop processing the packet in the middle,
the result is almost sure to be loss of networking.
Reported-by: Michael Dalton <mwdalton@google.com>
Acked-by: Michael Dalton <mwdalton@google.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/virtio_net.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 21f2b4a0f193..a2d19229f49b 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -344,7 +344,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, if (i >= MAX_SKB_FRAGS) { pr_debug("%s: packet too long\n", skb->dev->name); skb->dev->stats.rx_length_errors++; - return NULL; + goto err_frags; } page = virtqueue_get_buf(rq->vq, &len); if (!page) { @@ -365,6 +365,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, err_skb: give_pages(rq, page); while (--num_buf) { +err_frags: buf = virtqueue_get_buf(rq->vq, &len); if (unlikely(!buf)) { pr_debug("%s: rx error: %d buffers missing\n", |