xen/netfront: don't read data from request on the ring page
authorJuergen Gross <jgross@suse.com>
Mon, 29 Nov 2021 12:15:15 +0000 (13:15 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Dec 2021 07:45:04 +0000 (08:45 +0100)
commit4a8de7f80b9469e79c6ecf14f25050fa5982e803
treeb1c09482dcf67b3ab60e1ec16932fea656e3889e
parentd1227fc19df54646db66388e6749288a10c18ffe
xen/netfront: don't read data from request on the ring page

commit 162081ec33c2686afa29d91bf8d302824aa846c7 upstream.

In order to avoid a malicious backend being able to influence the local
processing of a request build the request locally first and then copy
it to the ring page. Any reading from the request influencing the
processing in the frontend needs to be done on the local instance.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/xen-netfront.c