xen/netback: only non-freed SKB is queued into tx_queue

annie-li · davem330 · commit 1e0b6eac6a15 · 2012-06-29T00:50:20.000-07:00
After SKB is queued into tx_queue, it will be freed if request_gop is NULL.
However, no dequeue action is called in this situation, it is likely that
tx_queue constains freed SKB. This patch should fix this issue, and it is
based on 3.5.0-rc4+.

This issue is found through code inspection, no bug is seen with it currently.
I run netperf test for several hours, and no network regression was found.

Signed-off-by: Annie Li &lt;annie.li@oracle.com&gt;
Acked-by: Ian Campbell &lt;ian.campbell@citrix.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
@@ -1363,8 +1363,6 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 					     INVALID_PENDING_IDX);
 		}
 
-		__skb_queue_tail(&netbk->tx_queue, skb);
-
 		netbk->pending_cons++;
 
 		request_gop = xen_netbk_get_requests(netbk, vif,
@@ -1376,6 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 		}
 		gop = request_gop;
 
+		__skb_queue_tail(&netbk->tx_queue, skb);
+
 		vif->tx.req_cons = idx;
 		xen_netbk_check_rx_xenvif(vif);
 

Original file line number	Diff line number	Diff line change
`@@ -1363,8 +1363,6 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)`
`1363`	`1363`	`INVALID_PENDING_IDX);`
`1364`	`1364`	`}`
`1365`	`1365`
`1366`		`- __skb_queue_tail(&netbk->tx_queue, skb);`
`1367`		`-`
`1368`	`1366`	`netbk->pending_cons++;`
`1369`	`1367`
`1370`	`1368`	`request_gop = xen_netbk_get_requests(netbk, vif,`
`@@ -1376,6 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)`
`1376`	`1374`	`}`
`1377`	`1375`	`gop = request_gop;`
`1378`	`1376`
	`1377`	`+ __skb_queue_tail(&netbk->tx_queue, skb);`
	`1378`	`+`
`1379`	`1379`	`vif->tx.req_cons = idx;`
`1380`	`1380`	`xen_netbk_check_rx_xenvif(vif);`
`1381`	`1381`