mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
xen-netback: use RING_COPY_REQUEST() throughout
Instead of open-coding memcpy()s and directly accessing Tx and Rx requests, use the new RING_COPY_REQUEST() that ensures the local copy is correct. This is more than is strictly necessary for guest Rx requests since only the id and gref fields are used and it is harmless if the frontend modifies these. This is part of XSA155. CC: stable@vger.kernel.org Reviewed-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: David Vrabel <david.vrabel@citrix.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
This commit is contained in:
parent
0f589967a7
commit
68a33bfd84
1 changed files with 14 additions and 16 deletions
|
@ -258,18 +258,18 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
|
|||
struct netrx_pending_operations *npo)
|
||||
{
|
||||
struct xenvif_rx_meta *meta;
|
||||
struct xen_netif_rx_request *req;
|
||||
struct xen_netif_rx_request req;
|
||||
|
||||
req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
|
||||
RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
|
||||
|
||||
meta = npo->meta + npo->meta_prod++;
|
||||
meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
|
||||
meta->gso_size = 0;
|
||||
meta->size = 0;
|
||||
meta->id = req->id;
|
||||
meta->id = req.id;
|
||||
|
||||
npo->copy_off = 0;
|
||||
npo->copy_gref = req->gref;
|
||||
npo->copy_gref = req.gref;
|
||||
|
||||
return meta;
|
||||
}
|
||||
|
@ -424,7 +424,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
|
|||
struct xenvif *vif = netdev_priv(skb->dev);
|
||||
int nr_frags = skb_shinfo(skb)->nr_frags;
|
||||
int i;
|
||||
struct xen_netif_rx_request *req;
|
||||
struct xen_netif_rx_request req;
|
||||
struct xenvif_rx_meta *meta;
|
||||
unsigned char *data;
|
||||
int head = 1;
|
||||
|
@ -443,15 +443,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
|
|||
|
||||
/* Set up a GSO prefix descriptor, if necessary */
|
||||
if ((1 << gso_type) & vif->gso_prefix_mask) {
|
||||
req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
|
||||
RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
|
||||
meta = npo->meta + npo->meta_prod++;
|
||||
meta->gso_type = gso_type;
|
||||
meta->gso_size = skb_shinfo(skb)->gso_size;
|
||||
meta->size = 0;
|
||||
meta->id = req->id;
|
||||
meta->id = req.id;
|
||||
}
|
||||
|
||||
req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
|
||||
RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
|
||||
meta = npo->meta + npo->meta_prod++;
|
||||
|
||||
if ((1 << gso_type) & vif->gso_mask) {
|
||||
|
@ -463,9 +463,9 @@ static int xenvif_gop_skb(struct sk_buff *skb,
|
|||
}
|
||||
|
||||
meta->size = 0;
|
||||
meta->id = req->id;
|
||||
meta->id = req.id;
|
||||
npo->copy_off = 0;
|
||||
npo->copy_gref = req->gref;
|
||||
npo->copy_gref = req.gref;
|
||||
|
||||
data = skb->data;
|
||||
while (data < skb_tail_pointer(skb)) {
|
||||
|
@ -709,7 +709,7 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
|
|||
spin_unlock_irqrestore(&queue->response_lock, flags);
|
||||
if (cons == end)
|
||||
break;
|
||||
txp = RING_GET_REQUEST(&queue->tx, cons++);
|
||||
RING_COPY_REQUEST(&queue->tx, cons++, txp);
|
||||
} while (1);
|
||||
queue->tx.req_cons = cons;
|
||||
}
|
||||
|
@ -776,8 +776,7 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
|
|||
if (drop_err)
|
||||
txp = &dropped_tx;
|
||||
|
||||
memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
|
||||
sizeof(*txp));
|
||||
RING_COPY_REQUEST(&queue->tx, cons + slots, txp);
|
||||
|
||||
/* If the guest submitted a frame >= 64 KiB then
|
||||
* first->size overflowed and following slots will
|
||||
|
@ -1110,8 +1109,7 @@ static int xenvif_get_extras(struct xenvif_queue *queue,
|
|||
return -EBADR;
|
||||
}
|
||||
|
||||
memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
|
||||
sizeof(extra));
|
||||
RING_COPY_REQUEST(&queue->tx, cons, &extra);
|
||||
if (unlikely(!extra.type ||
|
||||
extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
|
||||
queue->tx.req_cons = ++cons;
|
||||
|
@ -1320,7 +1318,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
|
|||
|
||||
idx = queue->tx.req_cons;
|
||||
rmb(); /* Ensure that we see the request before we copy it. */
|
||||
memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
|
||||
RING_COPY_REQUEST(&queue->tx, idx, &txreq);
|
||||
|
||||
/* Credit-based scheduling. */
|
||||
if (txreq.size > queue->remaining_credit &&
|
||||
|
|
Loading…
Reference in a new issue