leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'xen-netfront-xsa-403-follow-on'

Browse Source 
Jan Beulich says:

====================
xen-netfront: XSA-403 follow-on

While investigating the XSA, I did notice a few more things. The two
patches aren't really dependent on one another.

1: remove leftover call to xennet_tx_buf_gc()
2: re-order error checks in xennet_get_responses()
====================

Link: https://lore.kernel.org/r/7fca0e44-43b5-8448-3653-249d117dc084@suse.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni 2022-07-14 12:20:21 +02:00
commit b126047f43
1 changed files with 10 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/net/xen-netfront.c
View File

@ -1043,16 +1043,6 @@ static int xennet_get_responses(struct netfront_queue *queue,
}
for (;;) {
if (unlikely(rx->status < 0 ||
rx->offset + rx->status > XEN_PAGE_SIZE)) {
if (net_ratelimit())
dev_warn(dev, "rx->offset: %u, size: %d\n",
rx->offset, rx->status);
xennet_move_rx_slot(queue, skb, ref);
err = -EINVAL;
goto next;
}
/*
* This definitely indicates a bug, either in this driver or in
* the backend driver. In future this should flag the bad
@ -1066,6 +1056,16 @@ static int xennet_get_responses(struct netfront_queue *queue,
goto next;
}
if (unlikely(rx->status < 0 ||
rx->offset + rx->status > XEN_PAGE_SIZE)) {
if (net_ratelimit())
dev_warn(dev, "rx->offset: %u, size: %d\n",
rx->offset, rx->status);
xennet_move_rx_slot(queue, skb, ref);
err = -EINVAL;
goto next;
}
if (!gnttab_end_foreign_access_ref(ref)) {
dev_alert(dev,
"Grant still in use by backend domain\n");
@ -2464,10 +2464,6 @@ static int xennet_connect(struct net_device *dev)
if (queue->tx_irq != queue->rx_irq)
notify_remote_via_irq(queue->rx_irq);
spin_lock_irq(&queue->tx_lock);
xennet_tx_buf_gc(queue);
spin_unlock_irq(&queue->tx_lock);
spin_lock_bh(&queue->rx_lock);
xennet_alloc_rx_buffers(queue);
spin_unlock_bh(&queue->rx_lock);