127 lines
4.0 KiB
Diff
127 lines
4.0 KiB
Diff
From: David Vrabel <david.vrabel@citrix.com>
|
|
Date: Fri, 30 Oct 2015 15:17:06 +0000
|
|
Subject: [3/7] xen-netback: use RING_COPY_REQUEST() throughout
|
|
Origin: https://git.kernel.org/linus/68a33bfd8403e4e22847165d149823a2e0e67c9c
|
|
|
|
Instead of open-coding memcpy()s and directly accessing Tx and Rx
|
|
requests, use the new RING_COPY_REQUEST() that ensures the local copy
|
|
is correct.
|
|
|
|
This is more than is strictly necessary for guest Rx requests since
|
|
only the id and gref fields are used and it is harmless if the
|
|
frontend modifies these.
|
|
|
|
This is part of XSA155.
|
|
|
|
CC: stable@vger.kernel.org
|
|
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
|
|
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
|
|
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
|
|
---
|
|
drivers/net/xen-netback/netback.c | 30 ++++++++++++++----------------
|
|
1 file changed, 14 insertions(+), 16 deletions(-)
|
|
|
|
--- a/drivers/net/xen-netback/netback.c
|
|
+++ b/drivers/net/xen-netback/netback.c
|
|
@@ -258,18 +258,18 @@ static struct xenvif_rx_meta *get_next_r
|
|
struct netrx_pending_operations *npo)
|
|
{
|
|
struct xenvif_rx_meta *meta;
|
|
- struct xen_netif_rx_request *req;
|
|
+ struct xen_netif_rx_request req;
|
|
|
|
- req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
|
|
+ RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
|
|
|
|
meta = npo->meta + npo->meta_prod++;
|
|
meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
|
|
meta->gso_size = 0;
|
|
meta->size = 0;
|
|
- meta->id = req->id;
|
|
+ meta->id = req.id;
|
|
|
|
npo->copy_off = 0;
|
|
- npo->copy_gref = req->gref;
|
|
+ npo->copy_gref = req.gref;
|
|
|
|
return meta;
|
|
}
|
|
@@ -381,7 +381,7 @@ static int xenvif_gop_skb(struct sk_buff
|
|
struct xenvif *vif = netdev_priv(skb->dev);
|
|
int nr_frags = skb_shinfo(skb)->nr_frags;
|
|
int i;
|
|
- struct xen_netif_rx_request *req;
|
|
+ struct xen_netif_rx_request req;
|
|
struct xenvif_rx_meta *meta;
|
|
unsigned char *data;
|
|
int head = 1;
|
|
@@ -400,15 +400,15 @@ static int xenvif_gop_skb(struct sk_buff
|
|
|
|
/* Set up a GSO prefix descriptor, if necessary */
|
|
if ((1 << gso_type) & vif->gso_prefix_mask) {
|
|
- req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
|
|
+ RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
|
|
meta = npo->meta + npo->meta_prod++;
|
|
meta->gso_type = gso_type;
|
|
meta->gso_size = skb_shinfo(skb)->gso_size;
|
|
meta->size = 0;
|
|
- meta->id = req->id;
|
|
+ meta->id = req.id;
|
|
}
|
|
|
|
- req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
|
|
+ RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
|
|
meta = npo->meta + npo->meta_prod++;
|
|
|
|
if ((1 << gso_type) & vif->gso_mask) {
|
|
@@ -420,9 +420,9 @@ static int xenvif_gop_skb(struct sk_buff
|
|
}
|
|
|
|
meta->size = 0;
|
|
- meta->id = req->id;
|
|
+ meta->id = req.id;
|
|
npo->copy_off = 0;
|
|
- npo->copy_gref = req->gref;
|
|
+ npo->copy_gref = req.gref;
|
|
|
|
data = skb->data;
|
|
while (data < skb_tail_pointer(skb)) {
|
|
@@ -666,7 +666,7 @@ static void xenvif_tx_err(struct xenvif_
|
|
spin_unlock_irqrestore(&queue->response_lock, flags);
|
|
if (cons == end)
|
|
break;
|
|
- txp = RING_GET_REQUEST(&queue->tx, cons++);
|
|
+ RING_COPY_REQUEST(&queue->tx, cons++, txp);
|
|
} while (1);
|
|
queue->tx.req_cons = cons;
|
|
}
|
|
@@ -733,8 +733,7 @@ static int xenvif_count_requests(struct
|
|
if (drop_err)
|
|
txp = &dropped_tx;
|
|
|
|
- memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
|
|
- sizeof(*txp));
|
|
+ RING_COPY_REQUEST(&queue->tx, cons + slots, txp);
|
|
|
|
/* If the guest submitted a frame >= 64 KiB then
|
|
* first->size overflowed and following slots will
|
|
@@ -1067,8 +1066,7 @@ static int xenvif_get_extras(struct xenv
|
|
return -EBADR;
|
|
}
|
|
|
|
- memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
|
|
- sizeof(extra));
|
|
+ RING_COPY_REQUEST(&queue->tx, cons, &extra);
|
|
if (unlikely(!extra.type ||
|
|
extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
|
|
queue->tx.req_cons = ++cons;
|
|
@@ -1277,7 +1275,7 @@ static void xenvif_tx_build_gops(struct
|
|
|
|
idx = queue->tx.req_cons;
|
|
rmb(); /* Ensure that we see the request before we copy it. */
|
|
- memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
|
|
+ RING_COPY_REQUEST(&queue->tx, idx, &txreq);
|
|
|
|
/* Credit-based scheduling. */
|
|
if (txreq.size > queue->remaining_credit &&
|