Displaying 3 results from an estimated 3 matches for "17cc42c6a559".
2014 Oct 31
0
[PATCH] virtio_net: fix use after free
...sq->vq);
>
> return NETDEV_TX_OK;
I must say I am kind of confused by this patch.
Why the skb_orphan(skb) & nf_reset(skb) do not have the same issue ?
It looks like following patch is needed ?
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ec2a8b41ed41..17cc42c6a559 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -927,6 +927,10 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
/* Free up any pending old buffers before queueing new ones. */
free_old_xmit_skbs(sq);
+ /* Don't wait up for transmitted s...
2014 Oct 15
6
[PATCH] virtio_net: fix use after free
commit 0b725a2ca61bedc33a2a63d0451d528b268cf975
net: Remove ndo_xmit_flush netdev operation, use signalling instead.
added code that looks at skb->xmit_more after the skb has
been put in TX VQ. Since some paths process the ring and free the skb
immediately, this can cause use after free.
Fix by storing xmit_more in a local variable.
Cc: David S. Miller <davem at davemloft.net>
2014 Oct 15
6
[PATCH] virtio_net: fix use after free
commit 0b725a2ca61bedc33a2a63d0451d528b268cf975
net: Remove ndo_xmit_flush netdev operation, use signalling instead.
added code that looks at skb->xmit_more after the skb has
been put in TX VQ. Since some paths process the ring and free the skb
immediately, this can cause use after free.
Fix by storing xmit_more in a local variable.
Cc: David S. Miller <davem at davemloft.net>