mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
ntb_process_tx() handles an oversized buffer by calling tx_handler()
with a NULL data pointer and returning success. ntb_netdev therefore
neither frees the skb in its completion callback nor takes its enqueue
error path, leaking it.
Reject oversized buffers in ntb_transport_tx_enqueue() before acquiring
a queue entry and return -EMSGSIZE. The caller retains ownership of the
buffer, and the preceding netdev patch frees the skb when enqueue
returns this permanent error.
Fixes:
|
||
|---|---|---|
| .. | ||
| hw | ||
| test | ||
| core.c | ||
| Kconfig | ||
| Makefile | ||
| msi.c | ||
| ntb_transport.c | ||