]> git.baikalelectronics.ru Git - kernel.git/commit
xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses()
authorJan Beulich <jbeulich@suse.com>
Fri, 1 Jul 2022 07:57:19 +0000 (09:57 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 7 Jul 2022 15:53:32 +0000 (17:53 +0200)
commita1c6241d1b8dd771877698b52edfd7f660afe967
tree4c3aa78da0977a3631320f10abd80dec60125c27
parente7d5b85880b3faea6c6dae96b664d6e744b151ba
xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses()

commit 940f162d7facf05b183d6550db0b77f10b37a11d upstream.

The commit referenced below moved the invocation past the "next" label,
without any explanation. In fact this allows misbehaving backends undue
control over the domain the frontend runs in, as earlier detected errors
require the skb to not be freed (it may be retained for later processing
via xennet_move_rx_slot(), or it may simply be unsafe to have it freed).

This is CVE-2022-33743 / XSA-405.

Fixes: 9bf1756dc970 ("xen networking: add basic XDP support for xen-netfront")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/xen-netfront.c