Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7d1024f authored by Juergen Gross's avatar Juergen Gross Committed by Greg Kroah-Hartman
Browse files

xen/netfront: read response from backend only once 



commit 8446066bf8c1f9f7b7412c43fbea0fb87464d75b upstream.

In order to avoid problems in case the backend is modifying a response
on the ring page while the frontend has already seen it, just read the
response into a local buffer in one go and then operate on that buffer
only.

Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f89a0540

drivers/net/xen-netfront.c

+19 −19
Original line number Diff line number Diff line
@@ -389,13 +389,13 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) 
		rmb(); /* Ensure we see responses up to 'rp'. */



		for (cons = queue->tx.rsp_cons; cons != prod; cons++) {

			struct xen_netif_tx_response *txrsp;

			struct xen_netif_tx_response txrsp;



			txrsp = RING_GET_RESPONSE(&queue->tx, cons);

			if (txrsp->status == XEN_NETIF_RSP_NULL)

			RING_COPY_RESPONSE(&queue->tx, cons, &txrsp);

			if (txrsp.status == XEN_NETIF_RSP_NULL)

				continue;



			id  = txrsp->id;

			id  = txrsp.id;

			skb = queue->tx_skbs[id].skb;

			if (unlikely(gnttab_query_foreign_access(

				queue->grant_tx_ref[id]) != 0)) {
@@ -744,7 +744,7 @@ static int xennet_get_extras(struct netfront_queue *queue, 
			     RING_IDX rp)



{

	struct xen_netif_extra_info *extra;

	struct xen_netif_extra_info extra;

	struct device *dev = &queue->info->netdev->dev;

	RING_IDX cons = queue->rx.rsp_cons;

	int err = 0;
@@ -760,24 +760,22 @@ static int xennet_get_extras(struct netfront_queue *queue, 
			break;

		}



		extra = (struct xen_netif_extra_info *)

			RING_GET_RESPONSE(&queue->rx, ++cons);

		RING_COPY_RESPONSE(&queue->rx, ++cons, &extra);



		if (unlikely(!extra->type ||

			     extra->type >= XEN_NETIF_EXTRA_TYPE_MAX)) {

		if (unlikely(!extra.type ||

			     extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {

			if (net_ratelimit())

				dev_warn(dev, "Invalid extra type: %d\n",

					extra->type);

					 extra.type);

			err = -EINVAL;

		} else {

			memcpy(&extras[extra->type - 1], extra,

			       sizeof(*extra));

			extras[extra.type - 1] = extra;

		}



		skb = xennet_get_rx_skb(queue, cons);

		ref = xennet_get_rx_ref(queue, cons);

		xennet_move_rx_slot(queue, skb, ref);

	} while (extra->flags & XEN_NETIF_EXTRA_FLAG_MORE);

	} while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);



	queue->rx.rsp_cons = cons;

	return err;
@@ -787,7 +785,7 @@ static int xennet_get_responses(struct netfront_queue *queue, 
				struct netfront_rx_info *rinfo, RING_IDX rp,

				struct sk_buff_head *list)

{

	struct xen_netif_rx_response *rx = &rinfo->rx;

	struct xen_netif_rx_response *rx = &rinfo->rx, rx_local;

	struct xen_netif_extra_info *extras = rinfo->extras;

	struct device *dev = &queue->info->netdev->dev;

	RING_IDX cons = queue->rx.rsp_cons;
@@ -845,7 +843,8 @@ static int xennet_get_responses(struct netfront_queue *queue, 
			break;

		}



		rx = RING_GET_RESPONSE(&queue->rx, cons + slots);

		RING_COPY_RESPONSE(&queue->rx, cons + slots, &rx_local);

		rx = &rx_local;

		skb = xennet_get_rx_skb(queue, cons + slots);

		ref = xennet_get_rx_ref(queue, cons + slots);

		slots++;
@@ -900,10 +899,11 @@ static int xennet_fill_frags(struct netfront_queue *queue, 
	struct sk_buff *nskb;



	while ((nskb = __skb_dequeue(list))) {

		struct xen_netif_rx_response *rx =

			RING_GET_RESPONSE(&queue->rx, ++cons);

		struct xen_netif_rx_response rx;

		skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0];



		RING_COPY_RESPONSE(&queue->rx, ++cons, &rx);



		if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {

			unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
@@ -918,7 +918,7 @@ static int xennet_fill_frags(struct netfront_queue *queue, 


		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,

				skb_frag_page(nfrag),

				rx->offset, rx->status, PAGE_SIZE);

				rx.offset, rx.status, PAGE_SIZE);



		skb_shinfo(nskb)->nr_frags = 0;

		kfree_skb(nskb);
@@ -1016,7 +1016,7 @@ static int xennet_poll(struct napi_struct *napi, int budget) 
	i = queue->rx.rsp_cons;

	work_done = 0;

	while ((i != rp) && (work_done < budget)) {

		memcpy(rx, RING_GET_RESPONSE(&queue->rx, i), sizeof(*rx));

		RING_COPY_RESPONSE(&queue->rx, i, rx);

		memset(extras, 0, sizeof(rinfo.extras));



		err = xennet_get_responses(queue, &rinfo, rp, &tmpq);