diff mbox series

[SRU,HWE-5.17,1/1] xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses()

Message ID 20221012021758.55298-3-cengiz.can@canonical.com
State New
Headers show
Series [SRU,HWE-5.17,1/1] xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() | expand

Commit Message

Cengiz Can Oct. 12, 2022, 2:18 a.m. UTC 
From: Jan Beulich <jbeulich@suse.com>

The commit referenced below moved the invocation past the "next" label,
without any explanation. In fact this allows misbehaving backends undue
control over the domain the frontend runs in, as earlier detected errors
require the skb to not be freed (it may be retained for later processing
via xennet_move_rx_slot(), or it may simply be unsafe to have it freed).

This is CVE-2022-33743 / XSA-405.

Fixes: 6c5aa6fc4def ("xen networking: add basic XDP support for xen-netfront")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
CVE-2022-33743
(cherry picked from commit f63c2c2032c2e3caad9add3b82cc6e91c376fd26)
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 drivers/net/xen-netfront.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index daa4e6106aacc..f8c37f243c445 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1055,8 +1055,10 @@  static int xennet_get_responses(struct netfront_queue *queue,
 			}
 		}
 		rcu_read_unlock();
-next:
+
 		__skb_queue_tail(list, skb);
+
+next:
 		if (!(rx->flags & XEN_NETRXF_more_data))
 			break;