ia64/xen-unstable

changeset 6163:3fe7b0b7f6c5

Avoid stack overflow in netback by statically allocating the
grant-table map/unmap arrays. Spotted by Michael Vrable.
Signed-off-by: Keir Fraser <keir@xensource.com>
author kaf24@firebug.cl.cam.ac.uk
date Sun Aug 14 09:17:54 2005 +0000 (2005-08-14)
parents e03ffa8839ab
children 389aced92bc7 dfd2ded7b712
files linux-2.6-xen-sparse/drivers/xen/netback/netback.c
line diff
     1.1 --- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c	Sun Aug 14 09:07:56 2005 +0000
     1.2 +++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c	Sun Aug 14 09:17:54 2005 +0000
     1.3 @@ -58,7 +58,9 @@ static struct timer_list net_timer;
     1.4  static struct sk_buff_head rx_queue;
     1.5  static multicall_entry_t rx_mcl[NETIF_RX_RING_SIZE*2+1];
     1.6  static mmu_update_t rx_mmu[NETIF_RX_RING_SIZE];
     1.7 -#ifndef CONFIG_XEN_NETDEV_GRANT_RX
     1.8 +#ifdef CONFIG_XEN_NETDEV_GRANT_RX
     1.9 +static gnttab_donate_t grant_rx_op[MAX_PENDING_REQS];
    1.10 +#else
    1.11  static struct mmuext_op rx_mmuext[NETIF_RX_RING_SIZE];
    1.12  #endif
    1.13  static unsigned char rx_notify[NR_EVENT_CHANNELS];
    1.14 @@ -90,11 +92,9 @@ static struct sk_buff_head tx_queue;
    1.15  
    1.16  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
    1.17  static u16 grant_tx_ref[MAX_PENDING_REQS];
    1.18 -#endif
    1.19 -#ifdef CONFIG_XEN_NETDEV_GRANT_RX
    1.20 -static gnttab_donate_t grant_rx_op[MAX_PENDING_REQS];
    1.21 -#endif
    1.22 -#ifndef CONFIG_XEN_NETDEV_GRANT_TX
    1.23 +static gnttab_unmap_grant_ref_t tx_unmap_ops[MAX_PENDING_REQS];
    1.24 +static gnttab_map_grant_ref_t tx_map_ops[MAX_PENDING_REQS];
    1.25 +#else
    1.26  static multicall_entry_t tx_mcl[MAX_PENDING_REQS];
    1.27  #endif
    1.28  
    1.29 @@ -492,7 +492,6 @@ static void tx_credit_callback(unsigned 
    1.30  inline static void net_tx_action_dealloc(void)
    1.31  {
    1.32  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
    1.33 -    gnttab_unmap_grant_ref_t unmap_ops[MAX_PENDING_REQS];
    1.34      gnttab_unmap_grant_ref_t *gop;
    1.35  #else
    1.36      multicall_entry_t *mcl;
    1.37 @@ -508,8 +507,9 @@ inline static void net_tx_action_dealloc
    1.38      /*
    1.39       * Free up any grants we have finished using
    1.40       */
    1.41 -    gop = unmap_ops;
    1.42 -    while (dc != dp) {
    1.43 +    gop = tx_unmap_ops;
    1.44 +    while ( dc != dp )
    1.45 +    {
    1.46          pending_idx = dealloc_ring[MASK_PEND_IDX(dc++)];
    1.47          gop->host_addr    = MMAP_VADDR(pending_idx);
    1.48          gop->dev_bus_addr = 0;
    1.49 @@ -517,10 +517,8 @@ inline static void net_tx_action_dealloc
    1.50          grant_tx_ref[pending_idx] = GRANT_INVALID_REF;
    1.51          gop++;
    1.52      }
    1.53 -    if (unlikely(HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
    1.54 -                                           unmap_ops, gop - unmap_ops))) {
    1.55 -        BUG();
    1.56 -    }
    1.57 +    BUG_ON(HYPERVISOR_grant_table_op(
    1.58 +        GNTTABOP_unmap_grant_ref, tx_unmap_ops, gop - tx_unmap_ops));
    1.59  #else
    1.60      mcl = tx_mcl;
    1.61      while ( dc != dp )
    1.62 @@ -583,7 +581,6 @@ static void net_tx_action(unsigned long 
    1.63      u16 pending_idx;
    1.64      NETIF_RING_IDX i;
    1.65  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
    1.66 -    gnttab_map_grant_ref_t map_ops[MAX_PENDING_REQS];
    1.67      gnttab_map_grant_ref_t *mop;
    1.68  #else
    1.69      multicall_entry_t *mcl;
    1.70 @@ -594,7 +591,7 @@ static void net_tx_action(unsigned long 
    1.71          net_tx_action_dealloc();
    1.72  
    1.73  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
    1.74 -    mop = map_ops;
    1.75 +    mop = tx_map_ops;
    1.76  #else
    1.77      mcl = tx_mcl;
    1.78  #endif
    1.79 @@ -722,7 +719,7 @@ static void net_tx_action(unsigned long 
    1.80          pending_cons++;
    1.81  
    1.82  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
    1.83 -        if ((mop - map_ops) >= ARRAY_SIZE(map_ops))
    1.84 +        if ( (mop - tx_map_ops) >= ARRAY_SIZE(tx_map_ops) )
    1.85              break;
    1.86  #else
    1.87          /* Filled the batch queue? */
    1.88 @@ -732,20 +729,18 @@ static void net_tx_action(unsigned long 
    1.89      }
    1.90  
    1.91  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
    1.92 -    if (mop == map_ops) {
    1.93 +    if ( mop == tx_map_ops )
    1.94          return;
    1.95 -    }
    1.96 -    if (unlikely(HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref,
    1.97 -                                           map_ops, mop - map_ops))) {
    1.98 -        BUG();
    1.99 -    }
   1.100 -    mop = map_ops;
   1.101 +
   1.102 +    BUG_ON(HYPERVISOR_grant_table_op(
   1.103 +        GNTTABOP_map_grant_ref, tx_map_ops, mop - tx_map_ops));
   1.104 +
   1.105 +    mop = tx_map_ops;
   1.106  #else
   1.107      if ( mcl == tx_mcl )
   1.108          return;
   1.109  
   1.110 -    if ( unlikely(HYPERVISOR_multicall(tx_mcl, mcl - tx_mcl) != 0) )
   1.111 -        BUG();
   1.112 +    BUG_ON(HYPERVISOR_multicall(tx_mcl, mcl - tx_mcl) != 0);
   1.113  
   1.114      mcl = tx_mcl;
   1.115  #endif
   1.116 @@ -757,7 +752,8 @@ static void net_tx_action(unsigned long 
   1.117  
   1.118          /* Check the remap error code. */
   1.119  #ifdef CONFIG_XEN_NETDEV_GRANT_TX
   1.120 -        if (unlikely(mop->dev_bus_addr == 0)) {
   1.121 +        if ( unlikely(mop->dev_bus_addr == 0) )
   1.122 +        {
   1.123              printk(KERN_ALERT "#### netback grant fails\n");
   1.124              make_tx_response(netif, txreq.id, NETIF_RSP_ERROR);
   1.125              netif_put(netif);