[Xen-changelog] [linux-2.6.18-xen] netback: don't use last request to determine minimum Tx credit

[Xen patchbot-linux-2.6.18-xen <patchbot@xxxxxxx>]

# HG changeset patch
# User David Vrabel <david.vrabel@xxxxxxxxxx>
# Date 1450363113 -3600
# Node ID c3b5fe4e94c6f8623bc59f99cbab6f8467b2953b
# Parent  52a7179e39e70f9095cd93fee508116a342717c4
netback: don't use last request to determine minimum Tx credit

The last from guest transmitted request gives no indication about the
minimum amount of credit that the guest might need to send a packet
since the last packet might have been a small one.

Instead allow for the worst case 128 KiB packet.

This is part of CVE-2015-8550 / XSA-155.

Signed-off-by: David Vrabel <david.vrabel@xxxxxxxxxx>
Reviewed-by: Wei Liu <wei.liu2@xxxxxxxxxx>
Committed-by: Jan Beulich <jbeulich@xxxxxxxx>
---


diff -r 52a7179e39e7 -r c3b5fe4e94c6 drivers/xen/netback/netback.c
--- a/drivers/xen/netback/netback.c     Thu Dec 17 15:32:47 2015 +0100
+++ b/drivers/xen/netback/netback.c     Thu Dec 17 15:38:33 2015 +0100
@@ -868,9 +868,7 @@ static void tx_add_credit(netif_t *netif
         * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
         * Otherwise the interface can seize up due to insufficient credit.
         */
-       max_burst = RING_GET_REQUEST(&netif->tx, netif->tx.req_cons)->size;
-       max_burst = min(max_burst, 131072UL);
-       max_burst = max(max_burst, netif->credit_bytes);
+       max_burst = max(131072UL, netif->credit_bytes);
 
        /* Take care that adding a new chunk of credit doesn't wrap to zero. */
        max_credit = netif->remaining_credit + netif->credit_bytes;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog