Commit b126047f authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge branch 'xen-netfront-xsa-403-follow-on' 

Jan Beulich says:

====================
xen-netfront: XSA-403 follow-on

While investigating the XSA, I did notice a few more things. The two
patches aren't really dependent on one another.

1: remove leftover call to xennet_tx_buf_gc()
2: re-order error checks in xennet_get_responses()
====================

Link: https://lore.kernel.org/r/7fca0e44-43b5-8448-3653-249d117dc084@suse.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 9b633670 06673c21

drivers/net/xen-netfront.c

+10 −14
Original line number Diff line number Diff line
@@ -1043,16 +1043,6 @@ static int xennet_get_responses(struct netfront_queue *queue, 
	}



	for (;;) {

		if (unlikely(rx->status < 0 ||

			     rx->offset + rx->status > XEN_PAGE_SIZE)) {

			if (net_ratelimit())

				dev_warn(dev, "rx->offset: %u, size: %d\n",

					 rx->offset, rx->status);

			xennet_move_rx_slot(queue, skb, ref);

			err = -EINVAL;

			goto next;

		}



		/*

		 * This definitely indicates a bug, either in this driver or in

		 * the backend driver. In future this should flag the bad
@@ -1066,6 +1056,16 @@ static int xennet_get_responses(struct netfront_queue *queue, 
			goto next;

		}



		if (unlikely(rx->status < 0 ||

			     rx->offset + rx->status > XEN_PAGE_SIZE)) {

			if (net_ratelimit())

				dev_warn(dev, "rx->offset: %u, size: %d\n",

					 rx->offset, rx->status);

			xennet_move_rx_slot(queue, skb, ref);

			err = -EINVAL;

			goto next;

		}



		if (!gnttab_end_foreign_access_ref(ref)) {

			dev_alert(dev,

				  "Grant still in use by backend domain\n");
@@ -2464,10 +2464,6 @@ static int xennet_connect(struct net_device *dev) 
		if (queue->tx_irq != queue->rx_irq)

			notify_remote_via_irq(queue->rx_irq);



		spin_lock_irq(&queue->tx_lock);

		xennet_tx_buf_gc(queue);

		spin_unlock_irq(&queue->tx_lock);



		spin_lock_bh(&queue->rx_lock);

		xennet_alloc_rx_buffers(queue);

		spin_unlock_bh(&queue->rx_lock);