[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] Possible overflow in netbk_get_requests()

  • To: Simon Horman <horms@xxxxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxx>
  • From: Keir Fraser <keir.fraser@xxxxxxxxxxxxx>
  • Date: Mon, 04 Aug 2008 11:35:30 +0100
  • Cc:
  • Delivery-date: Mon, 04 Aug 2008 03:36:22 -0700
  • List-id: Xen developer discussion <xen-devel.lists.xensource.com>
  • Thread-index: Acj2HdDxD0OiGGIREd2MqAAX8io7RQ==
  • Thread-topic: [Xen-devel] Possible overflow in netbk_get_requests()

netbk_count_frags() should check we have no more than MAX_SKB_FRAGS for this
packet, and the loop header in net_tx_action() checks we do no more than
MAX_PENDING_REQS fragments of work (this is subtle: NR_PENDING_REQS cannot
decrease while we execute the loop!).

It's all a bit too subtle for its own good. ;-)

 -- Keir

On 4/8/08 03:48, "Simon Horman" <horms@xxxxxxxxxxxx> wrote:

> Hi,
> I'm wondering if the call to netbk_get_requests() in
> net_tx_action() might cause an overflow in the case where
> there are more fragments than available slots in tx_map_ops (aka mop).

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.