Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59ccb4eb authored by Wei Liu's avatar Wei Liu Committed by David S. Miller
Browse files

xen-netback: avoid allocating variable size array on stack 



Tune xen_netbk_count_requests to not touch working array beyond limit, so that
we can make working array size constant.

Suggested-by: default avatarJan Beulich <jbeulich@suse.com>
Signed-off-by: default avatarWei Liu <wei.liu2@citrix.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ac69c26e

drivers/net/xen-netback/netback.c

+14 −2
Original line number Original line Diff line number Diff line
@@ -934,11 +934,14 @@ static int netbk_count_requests(struct xenvif *vif, 
	RING_IDX cons = vif->tx.req_cons;

	RING_IDX cons = vif->tx.req_cons;

	int slots = 0;

	int slots = 0;

	int drop_err = 0;

	int drop_err = 0;

	int more_data;





	if (!(first->flags & XEN_NETTXF_more_data))

	if (!(first->flags & XEN_NETTXF_more_data))

		return 0;

		return 0;





	do {

	do {

		struct xen_netif_tx_request dropped_tx = { 0 };



		if (slots >= work_to_do) {

		if (slots >= work_to_do) {

			netdev_err(vif->dev,

			netdev_err(vif->dev,

				   "Asked for %d slots but exceeds this limit\n",

				   "Asked for %d slots but exceeds this limit\n",
@@ -972,6 +975,9 @@ static int netbk_count_requests(struct xenvif *vif, 
			drop_err = -E2BIG;

			drop_err = -E2BIG;

		}

		}





		if (drop_err)

			txp = &dropped_tx;



		memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots),

		memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots),

		       sizeof(*txp));

		       sizeof(*txp));
@@ -1001,7 +1007,13 @@ static int netbk_count_requests(struct xenvif *vif, 
			netbk_fatal_tx_err(vif);

			netbk_fatal_tx_err(vif);

			return -EINVAL;

			return -EINVAL;

		}

		}

	} while ((txp++)->flags & XEN_NETTXF_more_data);



		more_data = txp->flags & XEN_NETTXF_more_data;



		if (!drop_err)

			txp++;



	} while (more_data);





	if (drop_err) {

	if (drop_err) {

		netbk_tx_err(vif, first, cons + slots);

		netbk_tx_err(vif, first, cons + slots);
@@ -1408,7 +1420,7 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk) 
		!list_empty(&netbk->net_schedule_list)) {

		!list_empty(&netbk->net_schedule_list)) {

		struct xenvif *vif;

		struct xenvif *vif;

		struct xen_netif_tx_request txreq;

		struct xen_netif_tx_request txreq;

		struct xen_netif_tx_request txfrags[max_skb_slots];

		struct xen_netif_tx_request txfrags[XEN_NETIF_NR_SLOTS_MIN];

		struct page *page;

		struct page *page;

		struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX-1];

		struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX-1];

		u16 pending_idx;

		u16 pending_idx;