diff options
| author | Jason Wang <jasowang@redhat.com> | 2018-05-22 11:44:30 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-05-23 13:36:19 -0400 |
| commit | 850e088d5bbb333342fd4def08d0a4035f2b7126 (patch) | |
| tree | 95c9ecea1c103d8e4279bd78fa0e569b87a7d64b /drivers | |
| parent | 5d458a13dd59d04b4d6658a6d5b94d42732b15ae (diff) | |
| download | linux-850e088d5bbb333342fd4def08d0a4035f2b7126.tar.bz2 | |
virtio-net: correctly check num_buf during err path
If we successfully linearize the packet, num_buf will be set to zero
which may confuse error handling path which assumes num_buf is at
least 1 and this can lead the code tries to pop the descriptor of next
buffer. Fixing this by checking num_buf against 1 before decreasing.
Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/virtio_net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 6260d6549ee8..326e2476153d 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -875,7 +875,7 @@ err_xdp: rcu_read_unlock(); err_skb: put_page(page); - while (--num_buf) { + while (num_buf-- > 1) { buf = virtqueue_get_buf(rq->vq, &len); if (unlikely(!buf)) { pr_debug("%s: rx error: %d buffers missing\n", |