macvtap: read vnet_hdr_size once
commit 837585a5375c38d40361cfe64e6fd11e1addb936 upstream. When IFF_VNET_HDR is enabled, a virtio_net header must precede data. Data length is verified to be greater than or equal to expected header length tun->vnet_hdr_sz before copying. Macvtap functions read the value once, but unless READ_ONCE is used, the compiler may ignore this and read multiple times. Enforce a single read and locally cached value to avoid updates between test and use. Signed-off-by: Willem de Bruijn <willemb@google.com> Suggested-by: Eric Dumazet <edumazet@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> [wt: s/READ_ONCE/ACCESS_ONCE] Signed-off-by: Willy Tarreau <w@1wt.eu>
This commit is contained in:
parent
930e35d106
commit
bb4dfad283
|
@ -678,7 +678,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
|
|||
size_t linear;
|
||||
|
||||
if (q->flags & IFF_VNET_HDR) {
|
||||
vnet_hdr_len = q->vnet_hdr_sz;
|
||||
vnet_hdr_len = ACCESS_ONCE(q->vnet_hdr_sz);
|
||||
|
||||
err = -EINVAL;
|
||||
if (len < vnet_hdr_len)
|
||||
|
@ -809,7 +809,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
|
|||
|
||||
if (q->flags & IFF_VNET_HDR) {
|
||||
struct virtio_net_hdr vnet_hdr;
|
||||
vnet_hdr_len = q->vnet_hdr_sz;
|
||||
vnet_hdr_len = ACCESS_ONCE(q->vnet_hdr_sz);
|
||||
if ((len -= vnet_hdr_len) < 0)
|
||||
return -EINVAL;
|
||||
|
||||
|
|
Loading…
Reference in New Issue