Commit 03f191ba authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by David S. Miller

virtio-net: fix data corruption with OOM

virtio net used to unlink skbs from send queues on error,
but ever since 48925e37
we do not do this. This causes guest data corruption and crashes
with vhost since net core can requeue the skb or free it without
it being taken off the list.

This patch fixes this by queueing the skb after successful
transmit.
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 345056af
...@@ -517,8 +517,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -517,8 +517,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
/* Free up any pending old buffers before queueing new ones. */ /* Free up any pending old buffers before queueing new ones. */
free_old_xmit_skbs(vi); free_old_xmit_skbs(vi);
/* Put new one in send queue and do transmit */ /* Try to transmit */
__skb_queue_head(&vi->send, skb);
capacity = xmit_skb(vi, skb); capacity = xmit_skb(vi, skb);
/* This can happen with OOM and indirect buffers. */ /* This can happen with OOM and indirect buffers. */
...@@ -532,8 +531,17 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -532,8 +531,17 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
} }
return NETDEV_TX_BUSY; return NETDEV_TX_BUSY;
} }
vi->svq->vq_ops->kick(vi->svq); vi->svq->vq_ops->kick(vi->svq);
/*
* Put new one in send queue. You'd expect we'd need this before
* xmit_skb calls add_buf(), since the callback can be triggered
* immediately after that. But since the callback just triggers
* another call back here, normal network xmit locking prevents the
* race.
*/
__skb_queue_head(&vi->send, skb);
/* Don't wait up for transmitted skbs to be freed. */ /* Don't wait up for transmitted skbs to be freed. */
skb_orphan(skb); skb_orphan(skb);
nf_reset(skb); nf_reset(skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment