This is a note to let you know that I've just added the patch titled
xen-netback: Fix releasing frag_list skbs in error path
to the 3.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xen-netback-fix-releasing-frag_list-skbs-in-error-path.patch
and it can be found in the queue-3.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From foo@baz Sat Jul 26 10:16:13 PDT 2014
From: Zoltan Kiss <[email protected]>
Date: Fri, 18 Jul 2014 19:08:03 +0100
Subject: xen-netback: Fix releasing frag_list skbs in error path
From: Zoltan Kiss <[email protected]>
[ Upstream commit b42cc6e421e7bf74e545483aa34b99d2a2ca6d3a ]
When the grant operations failed, the skb is freed up eventually, and it tries
to release the frags, if there is any. For the main skb nr_frags is set to 0 to
avoid this, but on the frag_list it iterates through the frags array, and tries
to call put_page on the page pointer which contains garbage at that time.
Signed-off-by: Zoltan Kiss <[email protected]>
Reported-by: Armin Zentai <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/xen-netback/netback.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1498,7 +1498,16 @@ static int xenvif_tx_submit(struct xenvi
/* Check the remap error code. */
if (unlikely(xenvif_tx_check_gop(vif, skb, &gop_map,
&gop_copy))) {
+ /* If there was an error, xenvif_tx_check_gop is
+ * expected to release all the frags which were mapped,
+ * so kfree_skb shouldn't do it again
+ */
skb_shinfo(skb)->nr_frags = 0;
+ if (skb_has_frag_list(skb)) {
+ struct sk_buff *nskb =
+ skb_shinfo(skb)->frag_list;
+ skb_shinfo(nskb)->nr_frags = 0;
+ }
kfree_skb(skb);
continue;
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.15/xen-netback-fix-handling-frag_list-on-grant-op-error-path.patch
queue-3.15/xen-netback-fix-releasing-header-slot-on-error-path.patch
queue-3.15/xen-netback-fix-releasing-frag_list-skbs-in-error-path.patch
queue-3.15/xen-netback-fix-pointer-incrementation-to-avoid-incorrect-logging.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
