Commit 155cd575 authored by Jason Wang's avatar Jason Wang Committed by Greg Kroah-Hartman
Browse files

virtio-net: correctly check num_buf during err path 



[ Upstream commit 850e088d ]

If we successfully linearize the packet, num_buf will be set to zero
which may confuse error handling path which assumes num_buf is at
least 1 and this can lead the code tries to pop the descriptor of next
buffer. Fixing this by checking num_buf against 1 before decreasing.

Fixes: 4941d472 ("virtio-net: do not reset during XDP set")
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e2d47fa1

drivers/net/virtio_net.c

+1 −1
Original line number Diff line number Diff line
@@ -777,7 +777,7 @@ err_xdp: 
	rcu_read_unlock();

err_skb:

	put_page(page);

	while (--num_buf) {

	while (num_buf-- > 1) {

		buf = virtqueue_get_buf(rq->vq, &len);

		if (unlikely(!buf)) {

			pr_debug("%s: rx error: %d buffers missing\n",