Commit 1e0b6eac authored by Annie Li's avatar Annie Li Committed by David S. Miller

xen/netback: only non-freed SKB is queued into tx_queue

After SKB is queued into tx_queue, it will be freed if request_gop is NULL.
However, no dequeue action is called in this situation, it is likely that
tx_queue constains freed SKB. This patch should fix this issue, and it is
based on 3.5.0-rc4+.

This issue is found through code inspection, no bug is seen with it currently.
I run netperf test for several hours, and no network regression was found.
Signed-off-by: default avatarAnnie Li <annie.li@oracle.com>
Acked-by: default avatarIan Campbell <ian.campbell@citrix.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7fa8ad6d
...@@ -1363,8 +1363,6 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk) ...@@ -1363,8 +1363,6 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
INVALID_PENDING_IDX); INVALID_PENDING_IDX);
} }
__skb_queue_tail(&netbk->tx_queue, skb);
netbk->pending_cons++; netbk->pending_cons++;
request_gop = xen_netbk_get_requests(netbk, vif, request_gop = xen_netbk_get_requests(netbk, vif,
...@@ -1376,6 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk) ...@@ -1376,6 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
} }
gop = request_gop; gop = request_gop;
__skb_queue_tail(&netbk->tx_queue, skb);
vif->tx.req_cons = idx; vif->tx.req_cons = idx;
xen_netbk_check_rx_xenvif(vif); xen_netbk_check_rx_xenvif(vif);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment