aboutsummaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
authorMichael S. Tsirkin <mst@redhat.com>2013-12-26 15:32:55 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-01-15 15:28:49 -0800
commitfcd8e312578603626f0d78084d7ec2e444489aa4 (patch)
treeff19bd078056b8892d88019886259c95ec4adc41 /drivers/net
parent59d2a52eb56dcdaec3c81c456bf408cbab13bde6 (diff)
downloadlinaro-lsk-fcd8e312578603626f0d78084d7ec2e444489aa4.tar.gz
virtio_net: don't leak memory or block when too many frags
We leak an skb when there are too many frags, we also stop processing the packet in the middle, the result is almost sure to be loss of networking. Reported-by: Michael Dalton <mwdalton@google.com> Acked-by: Michael Dalton <mwdalton@google.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/virtio_net.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ec0e9f236ff..68692af1f48 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -341,7 +341,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
if (i >= MAX_SKB_FRAGS) {
pr_debug("%s: packet too long\n", skb->dev->name);
skb->dev->stats.rx_length_errors++;
- return NULL;
+ goto err_frags;
}
page = virtqueue_get_buf(rq->vq, &len);
if (!page) {
@@ -362,6 +362,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
err_skb:
give_pages(rq, page);
while (--num_buf) {
+err_frags:
buf = virtqueue_get_buf(rq->vq, &len);
if (unlikely(!buf)) {
pr_debug("%s: rx error: %d buffers missing\n",