Linux Virtualization - Dec 2013 - [PATCH] virtio-net: free bufs correctly on invalid packet length

When a packet with invalid length arrives, ensure that the packet
is freed correctly if mergeable packet buffers and big packets
(GUEST_TSO4) are both enabled.
---
 drivers/net/virtio_net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 916241d..6a4665c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -426,10 +426,10 @@ static void receive_buf(struct receive_queue *rq, void
*buf, unsigned int len)
 	if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
 		pr_debug("%s: short packet %i\n", dev->name, len);
 		dev->stats.rx_length_errors++;
-		if (vi->big_packets)
-			give_pages(rq, buf);
-		else if (vi->mergeable_rx_bufs)
+		if (vi->mergeable_rx_bufs)
 			put_page(virt_to_head_page(buf));
+		else if (vi->big_packets)
+			give_pages(rq, buf);
 		else
 			dev_kfree_skb(buf);
 		return;
-- 
1.8.5.1

Thanks Sergei,

Yes this is a similar bugfix, the patch I saw from Andrey
fixed this issue in free_unused_bufs. The problem also occurs when
dropping a packet that is too short.  Apologies for forgetting to
sign off on the patch, I will re-send.

Best,

Mike

Hello.

On 12/05/2013 11:16 PM, Michael Dalton wrote:
> When a packet with invalid length arrives, ensure that the packet
> is freed correctly if mergeable packet buffers and big packets
> (GUEST_TSO4) are both enabled.
    Looks like a similar patch have been posted by Andrey Vagin today. You 
also forgot to sign off the patch, so it can't be applied anyway.
> ---
>   drivers/net/virtio_net.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 916241d..6a4665c 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -426,10 +426,10 @@ static void receive_buf(struct receive_queue *rq,
void *buf, unsigned int len)
>   	if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
>   		pr_debug("%s: short packet %i\n", dev->name, len);
>   		dev->stats.rx_length_errors++;
> -		if (vi->big_packets)
> -			give_pages(rq, buf);
> -		else if (vi->mergeable_rx_bufs)
> +		if (vi->mergeable_rx_bufs)
>   			put_page(virt_to_head_page(buf));
> +		else if (vi->big_packets)
> +			give_pages(rq, buf);
>   		else
>   			dev_kfree_skb(buf);
>   		return;
WBR, Sergei