xen-netfront: reduce gso_max_size to account for max TCP header

[~andy/linux] / drivers / net / xen-netfront.c

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 7ffa43bd7cf9e9f3b1fc43f83d0ec4c53b355765..1db101415069726fc59d26443f773fc0432f52a6 100644 (file)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -36,7 +36,7 @@
 #include <linux/skbuff.h>
 #include <linux/ethtool.h>
 #include <linux/if_ether.h>
-#include <linux/tcp.h>
+#include <net/tcp.h>
 #include <linux/udp.h>
 #include <linux/moduleparam.h>
 #include <linux/mm.h>
@@ -537,7 +537,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct netfront_info *np = netdev_priv(dev);
        struct netfront_stats *stats = this_cpu_ptr(np->stats);
        struct xen_netif_tx_request *tx;
-       struct xen_netif_extra_info *extra;
        char *data = skb->data;
        RING_IDX i;
        grant_ref_t ref;
@@ -548,6 +547,16 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        unsigned int len = skb_headlen(skb);
        unsigned long flags;
 
+       /* If skb->len is too big for wire format, drop skb and alert
+        * user about misconfiguration.
+        */
+       if (unlikely(skb->len > XEN_NETIF_MAX_TX_SIZE)) {
+               net_alert_ratelimited(
+                       "xennet: skb->len = %u, too big for wire format\n",
+                       skb->len);
+               goto drop;
+       }
+
        slots = DIV_ROUND_UP(offset + len, PAGE_SIZE) +
                xennet_count_skb_frag_slots(skb);
        if (unlikely(slots > MAX_SKB_FRAGS + 1)) {
@@ -581,7 +590,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        tx->gref = np->grant_tx_ref[id] = ref;
        tx->offset = offset;
        tx->size = len;
-       extra = NULL;
 
        tx->flags = 0;
        if (skb->ip_summed == CHECKSUM_PARTIAL)
@@ -597,10 +605,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
                gso = (struct xen_netif_extra_info *)
                        RING_GET_REQUEST(&np->tx, ++i);
 
-               if (extra)
-                       extra->flags |= XEN_NETIF_EXTRA_FLAG_MORE;
-               else
-                       tx->flags |= XEN_NETTXF_extra_info;
+               tx->flags |= XEN_NETTXF_extra_info;
 
                gso->u.gso.size = skb_shinfo(skb)->gso_size;
                gso->u.gso.type = XEN_NETIF_GSO_TYPE_TCPV4;
@@ -609,7 +614,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                gso->type = XEN_NETIF_EXTRA_TYPE_GSO;
                gso->flags = 0;
-               extra = gso;
        }
 
        np->tx.req_prod_pvt = i + 1;
@@ -718,7 +722,7 @@ static int xennet_get_responses(struct netfront_info *np,
        struct sk_buff *skb = xennet_get_rx_skb(np, cons);
        grant_ref_t ref = xennet_get_rx_ref(np, cons);
        int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD);
-       int frags = 1;
+       int slots = 1;
        int err = 0;
        unsigned long ret;
 
@@ -741,7 +745,7 @@ static int xennet_get_responses(struct netfront_info *np,
                /*
                 * This definitely indicates a bug, either in this driver or in
                 * the backend driver. In future this should flag the bad
-                * situation to the system controller to reboot the backed.
+                * situation to the system controller to reboot the backend.
                 */
                if (ref == GRANT_INVALID_REF) {
                        if (net_ratelimit())
@@ -762,27 +766,27 @@ next:
                if (!(rx->flags & XEN_NETRXF_more_data))
                        break;
 
-               if (cons + frags == rp) {
+               if (cons + slots == rp) {
                        if (net_ratelimit())
-                               dev_warn(dev, "Need more frags\n");
+                               dev_warn(dev, "Need more slots\n");
                        err = -ENOENT;
                        break;
                }
 
-               rx = RING_GET_RESPONSE(&np->rx, cons + frags);
-               skb = xennet_get_rx_skb(np, cons + frags);
-               ref = xennet_get_rx_ref(np, cons + frags);
-               frags++;
+               rx = RING_GET_RESPONSE(&np->rx, cons + slots);
+               skb = xennet_get_rx_skb(np, cons + slots);
+               ref = xennet_get_rx_ref(np, cons + slots);
+               slots++;
        }
 
-       if (unlikely(frags > max)) {
+       if (unlikely(slots > max)) {
                if (net_ratelimit())
-                       dev_warn(dev, "Too many frags\n");
+                       dev_warn(dev, "Too many slots\n");
                err = -E2BIG;
        }
 
        if (unlikely(err))
-               np->rx.rsp_cons = cons + frags;
+               np->rx.rsp_cons = cons + slots;
 
        return err;
 }
@@ -1064,7 +1068,8 @@ err:
 
 static int xennet_change_mtu(struct net_device *dev, int mtu)
 {
-       int max = xennet_can_sg(dev) ? 65535 - ETH_HLEN : ETH_DATA_LEN;
+       int max = xennet_can_sg(dev) ?
+               XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
 
        if (mtu > max)
                return -EINVAL;
@@ -1368,6 +1373,8 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
        SET_ETHTOOL_OPS(netdev, &xennet_ethtool_ops);
        SET_NETDEV_DEV(netdev, &dev->dev);
 
+       netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
+
        np->netdev = netdev;
 
        netif_carrier_off(netdev);