diff options
| author | Jason Wang <jasowang@redhat.com> | 2018-05-22 11:44:30 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-06-11 22:49:21 +0200 |
| commit | 155cd575588bca1ef1dd77e37386a737f4c0153e (patch) | |
| tree | afa3d1aba8ec3b313baa651cfe1824d2d97bbe67 | |
| parent | e2d47fa107f98e131b2025aed208c4c9ed9549b9 (diff) | |
virtio-net: correctly check num_buf during err path
[ Upstream commit 850e088d5bbb333342fd4def08d0a4035f2b7126 ]
If we successfully linearize the packet, num_buf will be set to zero
which may confuse error handling path which assumes num_buf is at
least 1 and this can lead the code tries to pop the descriptor of next
buffer. Fixing this by checking num_buf against 1 before decreasing.
Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/virtio_net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 925d15ea35cb..c5a1d221c49b 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -777,7 +777,7 @@ err_xdp: rcu_read_unlock(); err_skb: put_page(page); - while (--num_buf) { + while (num_buf-- > 1) { buf = virtqueue_get_buf(rq->vq, &len); if (unlikely(!buf)) { pr_debug("%s: rx error: %d buffers missing\n", |