[3.16.y-ckt stable] Patch "xen-netfront: use correct linear area after linearizing an skb" has been added to staging queue

Luis Henriques luis.henriques at canonical.com
Wed Jan 21 14:02:54 UTC 2015


This is a note to let you know that I have just added a patch titled

    xen-netfront: use correct linear area after linearizing an skb

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt5.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From 02db7d0c534e3797e715689aaed6bcbcda661440 Mon Sep 17 00:00:00 2001
From: David Vrabel <david.vrabel at citrix.com>
Date: Tue, 9 Dec 2014 18:43:28 +0000
Subject: xen-netfront: use correct linear area after linearizing an skb

commit 11d3d2a16cc1f05c6ece69a4392e99efb85666a6 upstream.

Commit 97a6d1bb2b658ac85ed88205ccd1ab809899884d (xen-netfront: Fix
handling packets on compound pages with skb_linearize) attempted to
fix a problem where an skb that would have required too many slots
would be dropped causing TCP connections to stall.

However, it filled in the first slot using the original buffer and not
the new one and would use the wrong offset and grant access to the
wrong page.

Netback would notice the malformed request and stop all traffic on the
VIF, reporting:

    vif vif-3-0 vif3.0: txreq.offset: 85e, size: 4002, end: 6144
    vif vif-3-0 vif3.0: fatal error; disabling device

Reported-by: Anthony Wright <anthony at overnetdata.com>
Tested-by: Anthony Wright <anthony at overnetdata.com>
Signed-off-by: David Vrabel <david.vrabel at citrix.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Cc: Stefan Bader <stefan.bader at canonical.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 drivers/net/xen-netfront.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 3e0019503440..fc49005ddb5d 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -627,6 +627,9 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 				    slots, skb->len);
 		if (skb_linearize(skb))
 			goto drop;
+		data = skb->data;
+		offset = offset_in_page(data);
+		len = skb_headlen(skb);
 	}

 	spin_lock_irqsave(&queue->tx_lock, flags);
--
2.1.4





More information about the kernel-team mailing list