diff options
| author |   Paolo Abeni <pabeni@redhat.com> | 2022-07-14 12:20:21 +0200 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2022-07-14 12:20:21 +0200 |
| commit | b126047f43f11f61f1dd64802979765d71795dae (patch) | |
| tree | 4a65c6fdd94a7601fc9dcfddc9bd26e7c2dfb12b /drivers/net | |
| parent | octeontx2-af: Limit link bringup time at firmware (diff) | |
| parent | xen-netfront: re-order error checks in xennet_get_responses() (diff) | |
| download | linux-dev-b126047f43f11f61f1dd64802979765d71795dae.tar.xz linux-dev-b126047f43f11f61f1dd64802979765d71795dae.zip | |
Merge branch 'xen-netfront-xsa-403-follow-on'
Jan Beulich says:
====================
xen-netfront: XSA-403 follow-on
While investigating the XSA, I did notice a few more things. The two
patches aren't really dependent on one another.
1: remove leftover call to xennet_tx_buf_gc()
2: re-order error checks in xennet_get_responses()
====================
Link: https://lore.kernel.org/r/7fca0e44-43b5-8448-3653-249d117dc084@suse.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/xen-netfront.c | 24 |
1 files changed, 10 insertions, 14 deletions
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 2409007f1fd9..27a11cc08c61 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1043,16 +1043,6 @@ static int xennet_get_responses(struct netfront_queue *queue, } for (;;) { - if (unlikely(rx->status < 0 || - rx->offset + rx->status > XEN_PAGE_SIZE)) { - if (net_ratelimit()) - dev_warn(dev, "rx->offset: %u, size: %d\n", - rx->offset, rx->status); - xennet_move_rx_slot(queue, skb, ref); - err = -EINVAL; - goto next; - } - /* * This definitely indicates a bug, either in this driver or in * the backend driver. In future this should flag the bad @@ -1066,6 +1056,16 @@ static int xennet_get_responses(struct netfront_queue *queue, goto next; } + if (unlikely(rx->status < 0 || + rx->offset + rx->status > XEN_PAGE_SIZE)) { + if (net_ratelimit()) + dev_warn(dev, "rx->offset: %u, size: %d\n", + rx->offset, rx->status); + xennet_move_rx_slot(queue, skb, ref); + err = -EINVAL; + goto next; + } + if (!gnttab_end_foreign_access_ref(ref)) { dev_alert(dev, "Grant still in use by backend domain\n"); @@ -2464,10 +2464,6 @@ static int xennet_connect(struct net_device *dev) if (queue->tx_irq != queue->rx_irq) notify_remote_via_irq(queue->rx_irq); - spin_lock_irq(&queue->tx_lock); - xennet_tx_buf_gc(queue); - spin_unlock_irq(&queue->tx_lock); - spin_lock_bh(&queue->rx_lock); xennet_alloc_rx_buffers(queue); spin_unlock_bh(&queue->rx_lock); |