lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 20 Nov 2013 17:07:25 +0800
From:	Jason Wang <jasowang@...hat.com>
To:	rusty@...tcorp.com.au, mst@...hat.com,
	virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc:	Jason Wang <jasowang@...hat.com>,
	Michael Dalton <mwdalton@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>, Shirley Ma <xma@...ibm.com>
Subject: [PATCH net 1/3] virtio-net: drop the rest of buffers when we can't allocate skb

When mergeable buffer were used, we only put the first page buf leave the rest
of buffers in the virt queue. This will cause the driver could not get the
correct head buffer any more. Fix this by dropping the rest of buffers for this
packet.

The bug was introduced by commit 9ab86bbcf8be755256f0a5e994e0b38af6b4d399
(virtio_net: Defer skb allocation in receive path).

Cc: Rusty Russell <rusty@...tcorp.com.au>
Cc: Michael S. Tsirkin <mst@...hat.com>
Cc: Michael Dalton <mwdalton@...gle.com>
Cc: Eric Dumazet <edumazet@...gle.com>
Cc: Shirley Ma <xma@...ibm.com>
Signed-off-by: Jason Wang <jasowang@...hat.com>
---
This patch was needed for stable
---
 drivers/net/virtio_net.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7bab4de..24fd502 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -222,6 +222,17 @@ static void skb_xmit_done(struct virtqueue *vq)
 	netif_wake_subqueue(vi->dev, vq2txq(vq));
 }
 
+static void drop_mergeable_buffer(struct receive_queue *rq, int num_buf)
+{
+	char *buf;
+	int len;
+
+	while (--num_buf && (buf = virtqueue_get_buf(rq->vq, &len)) != NULL) {
+		--rq->num;
+		put_page(virt_to_head_page(buf));
+	}
+}
+
 /* Called from bottom half context */
 static struct sk_buff *page_to_skb(struct receive_queue *rq,
 				   struct page *page, unsigned int offset,
@@ -237,8 +248,13 @@ static struct sk_buff *page_to_skb(struct receive_queue *rq,
 
 	/* copy small packet so we can reuse these pages for small data */
 	skb = netdev_alloc_skb_ip_align(vi->dev, GOOD_COPY_LEN);
-	if (unlikely(!skb))
+	if (unlikely(!skb)) {
+		if (vi->mergeable_rx_bufs) {
+			hdr = (struct skb_vnet_hdr *)p;
+			drop_mergeable_buffer(rq, hdr->mhdr.num_buffers);
+		}
 		return NULL;
+	}
 
 	hdr = skb_vnet_hdr(skb);
 
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists