| From 68a33bfd8403e4e22847165d149823a2e0e67c9c Mon Sep 17 00:00:00 2001 |
| From: David Vrabel <david.vrabel@citrix.com> |
| Date: Fri, 30 Oct 2015 15:17:06 +0000 |
| Subject: xen-netback: use RING_COPY_REQUEST() throughout |
| |
| commit 68a33bfd8403e4e22847165d149823a2e0e67c9c upstream. |
| |
| Instead of open-coding memcpy()s and directly accessing Tx and Rx |
| requests, use the new RING_COPY_REQUEST() that ensures the local copy |
| is correct. |
| |
| This is more than is strictly necessary for guest Rx requests since |
| only the id and gref fields are used and it is harmless if the |
| frontend modifies these. |
| |
| This is part of XSA155. |
| |
| Reviewed-by: Wei Liu <wei.liu2@citrix.com> |
| Signed-off-by: David Vrabel <david.vrabel@citrix.com> |
| Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> |
| [lizf: Backported to 3.4: |
| - adjust context |
| - s/queue/vif/g] |
| Signed-off-by: Zefan Li <lizefan@huawei.com> |
| --- |
| drivers/net/xen-netback/netback.c | 30 ++++++++++++++---------------- |
| 1 file changed, 14 insertions(+), 16 deletions(-) |
| |
| --- a/drivers/net/xen-netback/netback.c |
| +++ b/drivers/net/xen-netback/netback.c |
| @@ -398,17 +398,17 @@ static struct netbk_rx_meta *get_next_rx |
| struct netrx_pending_operations *npo) |
| { |
| struct netbk_rx_meta *meta; |
| - struct xen_netif_rx_request *req; |
| + struct xen_netif_rx_request req; |
| |
| - req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++); |
| + RING_COPY_REQUEST(&vif->rx, vif->rx.req_cons++, &req); |
| |
| meta = npo->meta + npo->meta_prod++; |
| meta->gso_size = 0; |
| meta->size = 0; |
| - meta->id = req->id; |
| + meta->id = req.id; |
| |
| npo->copy_off = 0; |
| - npo->copy_gref = req->gref; |
| + npo->copy_gref = req.gref; |
| |
| return meta; |
| } |
| @@ -510,7 +510,7 @@ static int netbk_gop_skb(struct sk_buff |
| struct xenvif *vif = netdev_priv(skb->dev); |
| int nr_frags = skb_shinfo(skb)->nr_frags; |
| int i; |
| - struct xen_netif_rx_request *req; |
| + struct xen_netif_rx_request req; |
| struct netbk_rx_meta *meta; |
| unsigned char *data; |
| int head = 1; |
| @@ -520,14 +520,14 @@ static int netbk_gop_skb(struct sk_buff |
| |
| /* Set up a GSO prefix descriptor, if necessary */ |
| if (skb_shinfo(skb)->gso_size && vif->gso_prefix) { |
| - req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++); |
| + RING_COPY_REQUEST(&vif->rx, vif->rx.req_cons++, &req); |
| meta = npo->meta + npo->meta_prod++; |
| meta->gso_size = skb_shinfo(skb)->gso_size; |
| meta->size = 0; |
| - meta->id = req->id; |
| + meta->id = req.id; |
| } |
| |
| - req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++); |
| + RING_COPY_REQUEST(&vif->rx, vif->rx.req_cons++, &req); |
| meta = npo->meta + npo->meta_prod++; |
| |
| if (!vif->gso_prefix) |
| @@ -536,9 +536,9 @@ static int netbk_gop_skb(struct sk_buff |
| meta->gso_size = 0; |
| |
| meta->size = 0; |
| - meta->id = req->id; |
| + meta->id = req.id; |
| npo->copy_off = 0; |
| - npo->copy_gref = req->gref; |
| + npo->copy_gref = req.gref; |
| |
| data = skb->data; |
| while (data < skb_tail_pointer(skb)) { |
| @@ -882,7 +882,7 @@ static void netbk_tx_err(struct xenvif * |
| make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR); |
| if (cons == end) |
| break; |
| - txp = RING_GET_REQUEST(&vif->tx, cons++); |
| + RING_COPY_REQUEST(&vif->tx, cons++, txp); |
| } while (1); |
| vif->tx.req_cons = cons; |
| xen_netbk_check_rx_xenvif(vif); |
| @@ -943,8 +943,7 @@ static int netbk_count_requests(struct x |
| drop_err = -E2BIG; |
| } |
| |
| - memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots), |
| - sizeof(*txp)); |
| + RING_COPY_REQUEST(&vif->tx, cons + slots, txp); |
| |
| /* If the guest submitted a frame >= 64 KiB then |
| * first->size overflowed and following slots will |
| @@ -1226,8 +1225,7 @@ static int xen_netbk_get_extras(struct x |
| return -EBADR; |
| } |
| |
| - memcpy(&extra, RING_GET_REQUEST(&vif->tx, cons), |
| - sizeof(extra)); |
| + RING_COPY_REQUEST(&vif->tx, cons, &extra); |
| if (unlikely(!extra.type || |
| extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) { |
| vif->tx.req_cons = ++cons; |
| @@ -1422,7 +1420,7 @@ static unsigned xen_netbk_tx_build_gops( |
| |
| idx = vif->tx.req_cons; |
| rmb(); /* Ensure that we see the request before we copy it. */ |
| - memcpy(&txreq, RING_GET_REQUEST(&vif->tx, idx), sizeof(txreq)); |
| + RING_COPY_REQUEST(&vif->tx, idx, &txreq); |
| |
| /* Credit-based scheduling. */ |
| if (txreq.size > vif->remaining_credit && |