From: Eric Dumazet <eduma...@google.com> xennet_start_xmit() might copy skb with inappropriate layout into a fresh one.
Old skb is freed, and at this point it is not a drop, but a consume. New skb will then be either consumed or dropped. Signed-off-by: Eric Dumazet <eduma...@google.com> --- drivers/net/xen-netfront.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 7b61adb6270c..523387e71a80 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -611,7 +611,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) nskb = skb_copy(skb, GFP_ATOMIC); if (!nskb) goto drop; - dev_kfree_skb_any(skb); + dev_consume_skb_any(skb); skb = nskb; page = virt_to_page(skb->data); offset = offset_in_page(skb->data);