xen/netfront: don't read data from request on the ring page
authorJuergen Gross <jgross@suse.com>
Mon, 29 Nov 2021 11:23:51 +0000 (12:23 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Dec 2021 07:46:53 +0000 (08:46 +0100)
commitc010e30c398a5e73600bc40b006dc9d924ef3495
tree77d4bbc8f786de656161c901963c933b8f3bfba6
parent0ae52bcd3ec46c24c9a222edc5da6be4158cb7b5
xen/netfront: don't read data from request on the ring page

commit 162081ec33c2686afa29d91bf8d302824aa846c7 upstream.

In order to avoid a malicious backend being able to influence the local
processing of a request build the request locally first and then copy
it to the ring page. Any reading from the request influencing the
processing in the frontend needs to be done on the local instance.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/xen-netfront.c