Message ID | 20100106091532.GA10201@ff.dom.local |
---|---|
State | Superseded, archived |
Delegated to: | David Miller |
Headers | show |
On Wed, 6 Jan 2010 09:15:32 +0000 Jarek Poplawski <jarkao2@gmail.com> wrote: > tpacket_snd() can change and kfree an skb after dev_queue_xmit(), > which is illegal. > > With debugging by: Stephen Hemminger <shemminger@linux-foundation.org> > > Reported-by: Michael Breuer <mbreuer@majjas.com> > Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Good catch. Acked-by: Stephen Hemminger <shemminger@vyatta.com>
On Wed, Jan 06, 2010 at 06:49:57AM -0800, Stephen Hemminger wrote: > On Wed, 6 Jan 2010 09:15:32 +0000 > Jarek Poplawski <jarkao2@gmail.com> wrote: > > > tpacket_snd() can change and kfree an skb after dev_queue_xmit(), > > which is illegal. > > > > With debugging by: Stephen Hemminger <shemminger@linux-foundation.org> > > > > Reported-by: Michael Breuer <mbreuer@majjas.com> > > Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> > > Good catch. > Acked-by: Stephen Hemminger <shemminger@vyatta.com> First of all, we're incredibly lucky that such a helpful guy as Michael had misfortune to hit so helpfully broken piece of hardware ;-) Thanks, Jarek P. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index e0516a2..aba2049 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1021,9 +1021,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) status = TP_STATUS_SEND_REQUEST; err = dev_queue_xmit(skb); - if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0)) - goto out_xmit; packet_increment_head(&po->tx_ring); + if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0)) + goto out_put; + len_sum += tp_len; } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT)) && @@ -1033,9 +1034,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) err = len_sum; goto out_put; -out_xmit: - skb->destructor = sock_wfree; - atomic_dec(&po->tx_ring.pending); out_status: __packet_set_status(po, ph, status); kfree_skb(skb);