Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35876b5f authored by David Vrabel's avatar David Vrabel Committed by David S. Miller
Browse files

xen-netback: correctly return errors from netbk_count_requests() 



netbk_count_requests() could detect an error, call
netbk_fatal_tx_error() but return 0.  The vif may then be used
afterwards (e.g., in a call to netbk_tx_error().

Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may
be freed immediately after the call to netbk_fatal_tx_error() (e.g.,
if the vif is also removed).

Netback thread              Xenwatch thread
-------------------------------------------
netbk_fatal_tx_err()        netback_remove()
                              xenvif_disconnect()
                                ...
                                free_netdev()
netbk_tx_err() Oops!

Signed-off-by: default avatarWei Liu <wei.liu2@citrix.com>
Signed-off-by: default avatarJan Beulich <JBeulich@suse.com>
Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
Reported-by: default avatarChristopher S. Aker <caker@theshore.net>
Acked-by: default avatarIan Campbell <ian.campbell@citrix.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 306dbf9e

drivers/net/xen-netback/netback.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -911,13 +911,13 @@ static int netbk_count_requests(struct xenvif *vif, 
		if (frags >= work_to_do) {

		if (frags >= work_to_do) {

			netdev_err(vif->dev, "Need more frags\n");

			netdev_err(vif->dev, "Need more frags\n");

			netbk_fatal_tx_err(vif);

			netbk_fatal_tx_err(vif);

			return -frags;

			return -ENODATA;

		}

		}





		if (unlikely(frags >= MAX_SKB_FRAGS)) {

		if (unlikely(frags >= MAX_SKB_FRAGS)) {

			netdev_err(vif->dev, "Too many frags\n");

			netdev_err(vif->dev, "Too many frags\n");

			netbk_fatal_tx_err(vif);

			netbk_fatal_tx_err(vif);

			return -frags;

			return -E2BIG;

		}

		}





		memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),

		memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
@@ -925,7 +925,7 @@ static int netbk_count_requests(struct xenvif *vif, 
		if (txp->size > first->size) {

		if (txp->size > first->size) {

			netdev_err(vif->dev, "Frag is bigger than frame.\n");

			netdev_err(vif->dev, "Frag is bigger than frame.\n");

			netbk_fatal_tx_err(vif);

			netbk_fatal_tx_err(vif);

			return -frags;

			return -EIO;

		}

		}





		first->size -= txp->size;

		first->size -= txp->size;
@@ -935,7 +935,7 @@ static int netbk_count_requests(struct xenvif *vif, 
			netdev_err(vif->dev, "txp->offset: %x, size: %u\n",

			netdev_err(vif->dev, "txp->offset: %x, size: %u\n",

				 txp->offset, txp->size);

				 txp->offset, txp->size);

			netbk_fatal_tx_err(vif);

			netbk_fatal_tx_err(vif);

			return -frags;

			return -EINVAL;

		}

		}

	} while ((txp++)->flags & XEN_NETTXF_more_data);

	} while ((txp++)->flags & XEN_NETTXF_more_data);

	return frags;

	return frags;