From dd462c6eb2ba6af01ae38644183216c4d5603d90 Mon Sep 17 00:00:00 2001 From: Jan Kiszka Date: Tue, 3 Jan 2017 08:50:01 +0100 Subject: [PATCH] ivshmem-net: Switch to relative descriptor addresses Make sure that we do not depend on identity-mapped shared memory regions. This also fixes an off-by-one in the range check of ivshm_net_desc_data. Signed-off-by: Jan Kiszka (cherry picked from commit fe9c9dd6373892591a7d6b165c3c43045eb349c1) --- drivers/net/ivshmem-net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/net/ivshmem-net.c +++ b/drivers/net/ivshmem-net.c @@ -123,14 +123,14 @@ static void *ivshm_net_desc_data(struct struct vring_desc *desc, u32 *len) { - u64 addr = READ_ONCE(desc->addr); + u64 offs = READ_ONCE(desc->addr); u32 dlen = READ_ONCE(desc->len); void *data; - if (addr < in->shmaddr || desc->addr > in->shmaddr + in->shmlen) + if (offs >= in->shmlen) return NULL; - data = in->shm + (addr - in->shmaddr); + data = in->shm + offs; if (data < q->data || data >= q->end) return NULL; @@ -317,7 +317,7 @@ static int ivshm_net_tx_frame(struct net buf = tx->data + head; skb_copy_and_csum_dev(skb, buf); - desc->addr = in->shmaddr + (buf - in->shm); + desc->addr = buf - in->shm; desc->len = skb->len; avail = tx->last_avail_idx++ & (vr->num - 1);