Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 07:00:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

xen-netback: handle page straddling in xenvif_set_hash_mapping()

Browse Source 
There's no guarantee that the mapping array doesn't cross a page
boundary. Use a second grant copy operation if necessary.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jan Beulich 2018-09-25 02:13:37 -06:00 committed by David S. Miller
parent 22f9cde340
commit 871088bf92
1 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/net/xen-netback/hash.c
View File

@ -334,28 +334,39 @@ u32 xenvif_set_hash_mapping(struct xenvif *vif, u32 gref, u32 len,
u32 off)
{
u32 *mapping = vif->hash.mapping[!vif->hash.mapping_sel];
struct gnttab_copy copy_op = {
unsigned int nr = 1;
struct gnttab_copy copy_op[2] = {{
.source.u.ref = gref,
.source.domid = vif->domid,
.dest.domid = DOMID_SELF,
.len = len * sizeof(*mapping),
.flags = GNTCOPY_source_gref
};
}};
if ((off + len < off) || (off + len > vif->hash.size) ||
len > XEN_PAGE_SIZE / sizeof(*mapping))
return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
copy_op.dest.u.gmfn = virt_to_gfn(mapping + off);
copy_op.dest.offset = xen_offset_in_page(mapping + off);
copy_op[0].dest.u.gmfn = virt_to_gfn(mapping + off);
copy_op[0].dest.offset = xen_offset_in_page(mapping + off);
if (copy_op[0].dest.offset + copy_op[0].len > XEN_PAGE_SIZE) {
copy_op[1] = copy_op[0];
copy_op[1].source.offset = XEN_PAGE_SIZE - copy_op[0].dest.offset;
copy_op[1].dest.u.gmfn = virt_to_gfn(mapping + off + len);
copy_op[1].dest.offset = 0;
copy_op[1].len = copy_op[0].len - copy_op[1].source.offset;
copy_op[0].len = copy_op[1].source.offset;
nr = 2;
}
memcpy(mapping, vif->hash.mapping[vif->hash.mapping_sel],
vif->hash.size * sizeof(*mapping));
if (copy_op.len != 0) {
gnttab_batch_copy(&copy_op, 1);
if (copy_op[0].len != 0) {
gnttab_batch_copy(copy_op, nr);
if (copy_op.status != GNTST_okay)
if (copy_op[0].status != GNTST_okay ||
copy_op[nr - 1].status != GNTST_okay)
return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
}