Commit 88fae873 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by David S. Miller
Browse files

tap: fix use-after-free

Lockless access to __ptr_ring_full is only legal if ring is
never resized, otherwise it might cause use-after free errors.
Simply drop the lockless test, we'll drop the packet
a bit later when produce fails.

Fixes: 362899b8

 ("macvtap: switch to use skb array")
Signed-off-by: default avatarMichael S. Tsirkin <>
Signed-off-by: default avatarDavid S. Miller <>
parent a259df36
......@@ -330,9 +330,6 @@ rx_handler_result_t tap_handle_frame(struct sk_buff **pskb)
if (!q)
if (__ptr_ring_full(&q->ring))
goto drop;
skb_push(skb, ETH_HLEN);
/* Apply the forward feature mask so that we perform segmentation
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment