Unverified Commit ea4ad451 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1766 xen/netback: Fix buffer overrun triggered by unusual packet 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/UJLJJVQBOJD7O53XVRQKKNLXLEKK7DYT/ 
 
 
 
Link:https://gitee.com/openeuler/kernel/pulls/1766

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 399bacda aa3ee896

drivers/net/xen-netback/netback.c

+10 −5
Original line number Diff line number Diff line
@@ -393,7 +393,7 @@ static void xenvif_get_requests(struct xenvif_queue *queue, 
	struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops;

	struct xen_netif_tx_request *txp = first;



	nr_slots = shinfo->nr_frags + 1;

	nr_slots = shinfo->nr_frags + frag_overflow + 1;



	copy_count(skb) = 0;
@@ -448,8 +448,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue, 
		}

	}



	for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;

	     shinfo->nr_frags++, gop++) {

	for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS;

	     shinfo->nr_frags++, gop++, nr_slots--) {

		index = pending_index(queue->pending_cons++);

		pending_idx = queue->pending_ring[index];

		xenvif_tx_create_map_op(queue, pending_idx, txp,
@@ -462,12 +462,12 @@ static void xenvif_get_requests(struct xenvif_queue *queue, 
			txp++;

	}



	if (frag_overflow) {

	if (nr_slots > 0) {



		shinfo = skb_shinfo(nskb);

		frags = shinfo->frags;



		for (shinfo->nr_frags = 0; shinfo->nr_frags < frag_overflow;

		for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;

		     shinfo->nr_frags++, txp++, gop++) {

			index = pending_index(queue->pending_cons++);

			pending_idx = queue->pending_ring[index];
@@ -478,6 +478,11 @@ static void xenvif_get_requests(struct xenvif_queue *queue, 
		}



		skb_shinfo(skb)->frag_list = nskb;

	} else if (nskb) {

		/* A frag_list skb was allocated but it is no longer needed

		 * because enough slots were converted to copy ops above.

		 */

		kfree_skb(nskb);

	}



	(*copy_ops) = cop - queue->tx_copy_ops;