virtio: fix virtio_net xmit of freed skb bug

If we fail to transmit a packet, we assume the queue is full and put
the skb into last_xmit_skb.  However, if more space frees up before we
xmit it, we loop, and the result can be transmitting the same skb twice.

Fix is simple: set skb to NULL if we've used it in some way, and check
before sending.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

drivers/net/virtio_net.c

@@ -287,22 +287,26 @@ static int start_xmit(struct sk_buff *skb, struct net_device *dev)
 	free_old_xmit_skbs(vi);
 
 	/* If we has a buffer left over from last time, send it now. */
-	if (vi->last_xmit_skb) {
+	if (unlikely(vi->last_xmit_skb)) {
 		if (xmit_skb(vi, vi->last_xmit_skb) != 0) {
 			/* Drop this skb: we only queue one. */
 			vi->dev->stats.tx_dropped++;
 			kfree_skb(skb);
+			skb = NULL;
 			goto stop_queue;
 		}
 		vi->last_xmit_skb = NULL;
 	}
 
 	/* Put new one in send queue and do transmit */
+	if (likely(skb)) {
 		__skb_queue_head(&vi->send, skb);
 		if (xmit_skb(vi, skb) != 0) {
 			vi->last_xmit_skb = skb;
+			skb = NULL;
 			goto stop_queue;
 		}
+	}
 done:
 	vi->svq->vq_ops->kick(vi->svq);
 	return NETDEV_TX_OK;