xen/netback: don't call kfree_skb() with interrupts disabled
authorJuergen Gross <jgross@suse.com>
Tue, 6 Dec 2022 07:54:24 +0000 (08:54 +0100)
committerJuergen Gross <jgross@suse.com>
Tue, 6 Dec 2022 15:00:33 +0000 (16:00 +0100)
commit74e7e1efdad45580cc3839f2a155174cf158f9b5
tree1100c46e8284b318acc575598e9ab91560d895dd
parentad7f402ae4f466647c3a669b8a6f3e5d4271c84a
xen/netback: don't call kfree_skb() with interrupts disabled

It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So remove kfree_skb()
from the spin_lock_irqsave() section and use the already existing
"drop" label in xenvif_start_xmit() for dropping the SKB. At the
same time replace the dev_kfree_skb() call there with a call of
dev_kfree_skb_any(), as xenvif_start_xmit() can be called with
disabled interrupts.

This is XSA-424 / CVE-2022-42328 / CVE-2022-42329.

Fixes: be81992f9086 ("xen/netback: don't queue unlimited number of packages")
Reported-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
drivers/net/xen-netback/common.h
drivers/net/xen-netback/interface.c
drivers/net/xen-netback/rx.c