diff options
| author | Juergen Gross <jgross@suse.com> | 2022-12-06 08:54:24 +0100 |
|---|---|---|
| committer | Juergen Gross <jgross@suse.com> | 2022-12-06 16:00:33 +0100 |
| commit | 74e7e1efdad45580cc3839f2a155174cf158f9b5 (patch) | |
| tree | 1100c46e8284b318acc575598e9ab91560d895dd /drivers/net/xen-netback/common.h | |
| parent | ad7f402ae4f466647c3a669b8a6f3e5d4271c84a (diff) | |
| download | linux-74e7e1efdad45580cc3839f2a155174cf158f9b5.tar.gz | |
xen/netback: don't call kfree_skb() with interrupts disabled
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So remove kfree_skb()
from the spin_lock_irqsave() section and use the already existing
"drop" label in xenvif_start_xmit() for dropping the SKB. At the
same time replace the dev_kfree_skb() call there with a call of
dev_kfree_skb_any(), as xenvif_start_xmit() can be called with
disabled interrupts.
This is XSA-424 / CVE-2022-42328 / CVE-2022-42329.
Fixes: be81992f9086 ("xen/netback: don't queue unlimited number of packages")
Reported-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Diffstat (limited to 'drivers/net/xen-netback/common.h')
| -rw-r--r-- | drivers/net/xen-netback/common.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h index 1545cbee77a4..3dbfc8a6924e 100644 --- a/drivers/net/xen-netback/common.h +++ b/drivers/net/xen-netback/common.h @@ -386,7 +386,7 @@ int xenvif_dealloc_kthread(void *data); irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data); bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread); -void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); +bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); void xenvif_carrier_on(struct xenvif *vif); |