From: Willem de Bruijn Date: Fri, 3 Feb 2017 23:20:49 +0000 (-0500) Subject: macvtap: read vnet_hdr_size once X-Git-Tag: v3.10.107~127 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b0899f80092e17d83979cd6c2825a5d4ee2cdcf7;p=thirdparty%2Fkernel%2Fstable.git macvtap: read vnet_hdr_size once commit 837585a5375c38d40361cfe64e6fd11e1addb936 upstream. When IFF_VNET_HDR is enabled, a virtio_net header must precede data. Data length is verified to be greater than or equal to expected header length tun->vnet_hdr_sz before copying. Macvtap functions read the value once, but unless READ_ONCE is used, the compiler may ignore this and read multiple times. Enforce a single read and locally cached value to avoid updates between test and use. Signed-off-by: Willem de Bruijn Suggested-by: Eric Dumazet Acked-by: Eric Dumazet Signed-off-by: David S. Miller [wt: s/READ_ONCE/ACCESS_ONCE] Signed-off-by: Willy Tarreau --- diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c index 8fc46fcaee54e..1c51abbecedbc 100644 --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -678,7 +678,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, size_t linear; if (q->flags & IFF_VNET_HDR) { - vnet_hdr_len = q->vnet_hdr_sz; + vnet_hdr_len = ACCESS_ONCE(q->vnet_hdr_sz); err = -EINVAL; if (len < vnet_hdr_len) @@ -809,7 +809,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q, if (q->flags & IFF_VNET_HDR) { struct virtio_net_hdr vnet_hdr; - vnet_hdr_len = q->vnet_hdr_sz; + vnet_hdr_len = ACCESS_ONCE(q->vnet_hdr_sz); if ((len -= vnet_hdr_len) < 0) return -EINVAL;