1e584c304c
virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.
Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| af_vsock.c | ||
| af_vsock_tap.c | ||
| diag.c | ||
| hyperv_transport.c | ||
| virtio_transport.c | ||
| virtio_transport_common.c | ||
| vmci_transport.c | ||
| vmci_transport.h | ||
| vmci_transport_notify.c | ||
| vmci_transport_notify.h | ||
| vmci_transport_notify_qstate.c | ||
| vsock_addr.c | ||
| vsock_bpf.c | ||
| vsock_loopback.c | ||