Home| summaryrefslogtreecommitdiff |
diff options
| author | Takashi Iwai <tiwai@suse.de> | 2018-08-14 19:51:27 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2018-08-14 19:51:27 +0200 |
| commit | 9fb5ebbeeea648043995b71742e6617d2710d2ef (patch) | |
| tree | 34c38318ca1c78973363a35f229e06b522063e12 | |
| parent | abc33e3a8ab36862be7e54adc19a3aba2c82b549 (diff) | |
| parent | 7319c29e215886b058a4f993fe631ebf3cd1fc17 (diff) | |
Merge branch 'SLE15_EMBARGO' into openSUSE-15.0_EMBARGO
suse-commit: 28574e6de5a2c9dfaab3b3e3f975219f7e404c5c
| -rw-r--r-- | drivers/net/xen-netback/hash.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c index 3c4c58b9fe76..3b6fb5b3bdb2 100644 --- a/drivers/net/xen-netback/hash.c +++ b/drivers/net/xen-netback/hash.c @@ -332,20 +332,22 @@ u32 xenvif_set_hash_mapping_size(struct xenvif *vif, u32 size) u32 xenvif_set_hash_mapping(struct xenvif *vif, u32 gref, u32 len, u32 off) { - u32 *mapping = &vif->hash.mapping[off]; + u32 *mapping = vif->hash.mapping; struct gnttab_copy copy_op = { .source.u.ref = gref, .source.domid = vif->domid, - .dest.u.gmfn = virt_to_gfn(mapping), .dest.domid = DOMID_SELF, - .dest.offset = xen_offset_in_page(mapping), - .len = len * sizeof(u32), + .len = len * sizeof(*mapping), .flags = GNTCOPY_source_gref }; - if ((off + len > vif->hash.size) || copy_op.len > XEN_PAGE_SIZE) + if ((off + len < off) || (off + len > vif->hash.size) || + len > XEN_PAGE_SIZE / sizeof(*mapping)) return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER; + copy_op.dest.u.gmfn = virt_to_gfn(mapping + off); + copy_op.dest.offset = xen_offset_in_page(mapping + off); + while (len-- != 0) if (mapping[off++] >= vif->num_queues) return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER; |