Skip to content
Snippets Groups Projects
Forked from Alex Deucher / linux
Source project has a limited visibility.
  • Juergen Gross's avatar
    b27d4795
    xen/netfront: harden netfront against event channel storms · b27d4795
    Juergen Gross authored
    
    The Xen netfront driver is still vulnerable for an attack via excessive
    number of events sent by the backend. Fix that by using lateeoi event
    channels.
    
    For being able to detect the case of no rx responses being added while
    the carrier is down a new lock is needed in order to update and test
    rsp_cons and the number of seen unconsumed responses atomically.
    
    This is part of XSA-391
    
    Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
    Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
    ---
    V2:
    - don't eoi irq in case of interface set broken (Jan Beulich)
    - handle carrier off + no new responses added (Jan Beulich)
    V3:
    - add rx_ prefix to rsp_unconsumed (Jan Beulich)
    - correct xennet_set_rx_rsp_cons() spelling (Jan Beulich)
    b27d4795
    History
    xen/netfront: harden netfront against event channel storms
    Juergen Gross authored
    
    The Xen netfront driver is still vulnerable for an attack via excessive
    number of events sent by the backend. Fix that by using lateeoi event
    channels.
    
    For being able to detect the case of no rx responses being added while
    the carrier is down a new lock is needed in order to update and test
    rsp_cons and the number of seen unconsumed responses atomically.
    
    This is part of XSA-391
    
    Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
    Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
    ---
    V2:
    - don't eoi irq in case of interface set broken (Jan Beulich)
    - handle carrier off + no new responses added (Jan Beulich)
    V3:
    - add rx_ prefix to rsp_unconsumed (Jan Beulich)
    - correct xennet_set_rx_rsp_cons() spelling (Jan Beulich)