Commit 850e088d authored by Jason Wang's avatar Jason Wang Committed by David S. Miller

virtio-net: correctly check num_buf during err path

If we successfully linearize the packet, num_buf will be set to zero
which may confuse error handling path which assumes num_buf is at
least 1 and this can lead the code tries to pop the descriptor of next
buffer. Fixing this by checking num_buf against 1 before decreasing.

Fixes: 4941d472 ("virtio-net: do not reset during XDP set")
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5d458a13
...@@ -875,7 +875,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, ...@@ -875,7 +875,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
rcu_read_unlock(); rcu_read_unlock();
err_skb: err_skb:
put_page(page); put_page(page);
while (--num_buf) { while (num_buf-- > 1) {
buf = virtqueue_get_buf(rq->vq, &len); buf = virtqueue_get_buf(rq->vq, &len);
if (unlikely(!buf)) { if (unlikely(!buf)) {
pr_debug("%s: rx error: %d buffers missing\n", pr_debug("%s: rx error: %d buffers missing\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment