tree dbc7f5ba9c5f708338ea2cd8e47536a9ecfaa501
parent 37093de83d2df7d1c040642bdf6a6c6db7e93d74
author Juergen Gross <jgross@suse.com> 1638188206 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1638949504 +0100

xen/netfront: don't trust the backend response data blindly

commit a884daa61a7d91650987e855464526aef219590f upstream.

Today netfront will trust the backend to send only sane response data.
In order to avoid privilege escalations or crashes in case of malicious
backends verify the data to be within expected limits. Especially make
sure that the response always references an outstanding request.

Note that only the tx queue needs special id handling, as for the rx
queue the id is equal to the index in the ring page.

Introduce a new indicator for the device whether it is broken and let
the device stop working when it is set. Set this indicator in case the
backend sets any weird data.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>