From b6a90598adffd46be045dfb6eeadfd66daf94e2a Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" Date: Wed, 28 Oct 2009 04:03:38 -0700 Subject: [PATCH] virtio-net: fix data corruption with OOM virtio net used to unlink skbs from send queues on error, but ever since e93d646a6c3ef84a9b1081139aac6be48c4f581c we do not do this. This causes guest data corruption and crashes with vhost since net core can requeue the skb or free it without it being taken off the list. This patch fixes this by queueing the skb after successful transmit. Signed-off-by: Michael S. Tsirkin Signed-off-by: Rusty Russell Signed-off-by: David S. Miller --- drivers/net/virtio_net.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 54bf0912b7373..d9ebac8a2d99d 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -517,8 +517,7 @@ again: /* Free up any pending old buffers before queueing new ones. */ free_old_xmit_skbs(vi); - /* Put new one in send queue and do transmit */ - __skb_queue_head(&vi->send, skb); + /* Try to transmit */ capacity = xmit_skb(vi, skb); /* This can happen with OOM and indirect buffers. */ @@ -532,8 +531,17 @@ again: } return NETDEV_TX_BUSY; } - vi->svq->vq_ops->kick(vi->svq); + + /* + * Put new one in send queue. You'd expect we'd need this before + * xmit_skb calls add_buf(), since the callback can be triggered + * immediately after that. But since the callback just triggers + * another call back here, normal network xmit locking prevents the + * race. + */ + __skb_queue_head(&vi->send, skb); + /* Don't wait up for transmitted skbs to be freed. */ skb_orphan(skb); nf_reset(skb); -- 2.39.5