From: Eric Dumazet <eduma...@google.com>

xennet_start_xmit() might copy skb with inappropriate layout
into a fresh one.

Old skb is freed, and at this point it is not a drop, but
a consume. New skb will then be either consumed or dropped. 

Signed-off-by: Eric Dumazet <eduma...@google.com>
---
 drivers/net/xen-netfront.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 7b61adb6270c..523387e71a80 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -611,7 +611,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct 
net_device *dev)
                nskb = skb_copy(skb, GFP_ATOMIC);
                if (!nskb)
                        goto drop;
-               dev_kfree_skb_any(skb);
+               dev_consume_skb_any(skb);
                skb = nskb;
                page = virt_to_page(skb->data);
                offset = offset_in_page(skb->data);


Reply via email to