xen-netback: avoid allocating variable size array on stack

commit 59ccb4ebbc35e36a3c143f2d1355deb75c2e628f upstream.

Tune xen_netbk_count_requests to not touch working array beyond limit, so that
we can make working array size constant.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 8772d1ed9c50cd2f2898a0b9f1dc693edc3c6754..5e5f31fa02d17ab9bf1407bbf4eab8203865338c 100644 (file)
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -906,11 +906,14 @@ static int netbk_count_requests(struct xenvif *vif,
        RING_IDX cons = vif->tx.req_cons;
        int slots = 0;
        int drop_err = 0;
+       int more_data;
 
        if (!(first->flags & XEN_NETTXF_more_data))
                return 0;
 
        do {
+               struct xen_netif_tx_request dropped_tx = { 0 };
+
                if (slots >= work_to_do) {
                        netdev_err(vif->dev,
                                   "Asked for %d slots but exceeds this limit\n",
@@ -944,6 +947,9 @@ static int netbk_count_requests(struct xenvif *vif,
                        drop_err = -E2BIG;
                }
 
+               if (drop_err)
+                       txp = &dropped_tx;
+
                memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots),
                       sizeof(*txp));
 
@@ -973,7 +979,13 @@ static int netbk_count_requests(struct xenvif *vif,
                        netbk_fatal_tx_err(vif);
                        return -EINVAL;
                }
-       } while ((txp++)->flags & XEN_NETTXF_more_data);
+
+               more_data = txp->flags & XEN_NETTXF_more_data;
+
+               if (!drop_err)
+                       txp++;
+
+       } while (more_data);
 
        if (drop_err) {
                netbk_tx_err(vif, first, cons + slots);
@@ -1385,7 +1397,7 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                !list_empty(&netbk->net_schedule_list)) {
                struct xenvif *vif;
                struct xen_netif_tx_request txreq;
-               struct xen_netif_tx_request txfrags[max_skb_slots];
+               struct xen_netif_tx_request txfrags[XEN_NETIF_NR_SLOTS_MIN];
                struct page *page;
                struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX-1];
                u16 pending_idx;