Re: [PATCH net] xen/netfront: don't leak the skb when xennet_fill_frags() fails

[Juergen Gross]

On 07.10.26 19:57, Josef Bacik wrote:
> When a response chain has more slots than fit in the skb's frags,
> xennet_fill_frags() returns an error and xennet_poll() jumps to its
> error path.  That path moves what's left on tmpq to errq to be freed,
> but the skb being filled was already dequeued from tmpq, so it's never
> freed.  Each chain that overflows leaks the skb and the pages attached
> to it as frags, and the backend decides how many slots it sends.
>
> Put the skb back on tmpq before taking the error path, like the
> xennet_set_skb_gso() failure just above it does.
>
> Fixes: ad4f15dc2c70 ("xen/netfront: don't bug in case of too many frags")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature