Skip to content

Commit 7d767a9

Browse files
torvaldstorvalds
committed
Merge tag 'for-linus-6.17-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen updates from Juergen Gross: - fix for a UAF in the xen gntdev-dmabuf driver - fix in the xen netfront driver avoiding spurious interrupts - fix in the gntdev driver avoiding a large stack allocation - cleanup removing some dead code - build warning fix - cleanup of the sysfs code in the xen-pciback driver * tag 'for-linus-6.17-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/netfront: Fix TX response spurious interrupts xen/gntdev: remove struct gntdev_copy_batch from stack xen: fix UAF in dmabuf_exp_from_pages() xen: Remove some deadcode (x) xen-pciback: Replace scnprintf() with sysfs_emit_at() xen/xenbus: fix W=1 build warning in xenbus_va_dev_error function
2 parents 2be6a75 + 114a2de commit 7d767a9

File tree

11 files changed

+72
-85
lines changed

11 files changed

+72
-85
lines changed

‎drivers/net/xen-netfront.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -638,8 +638,6 @@ static int xennet_xdp_xmit_one(struct net_device *dev,
638638
tx_stats->packets++;
639639
u64_stats_update_end(&tx_stats->syncp);
640640

641-
xennet_tx_buf_gc(queue);
642-
643641
return 0;
644642
}
645643

@@ -849,9 +847,6 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
849847
tx_stats->packets++;
850848
u64_stats_update_end(&tx_stats->syncp);
851849

852-
/* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
853-
xennet_tx_buf_gc(queue);
854-
855850
if (!netfront_tx_slot_available(queue))
856851
netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
857852

‎drivers/xen/gntdev-common.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ struct gntdev_priv {
2626
/* lock protects maps and freeable_maps. */
2727
struct mutex lock;
2828

29+
/* Free instances of struct gntdev_copy_batch. */
30+
struct gntdev_copy_batch *batch;
31+
struct mutex batch_lock;
32+
2933
#ifdef CONFIG_XEN_GRANT_DMA_ALLOC
3034
/* Device for which DMA memory is allocated. */
3135
struct device *dma_dev;

‎drivers/xen/gntdev-dmabuf.c

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -357,8 +357,11 @@ struct gntdev_dmabuf_export_args {
357357
static int dmabuf_exp_from_pages(struct gntdev_dmabuf_export_args *args)
358358
{
359359
DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
360-
struct gntdev_dmabuf *gntdev_dmabuf;
361-
int ret;
360+
struct gntdev_dmabuf *gntdev_dmabuf __free(kfree) = NULL;
361+
CLASS(get_unused_fd, ret)(O_CLOEXEC);
362+
363+
if (ret < 0)
364+
return ret;
362365

363366
gntdev_dmabuf = kzalloc(sizeof(*gntdev_dmabuf), GFP_KERNEL);
364367
if (!gntdev_dmabuf)
@@ -383,32 +386,21 @@ static int dmabuf_exp_from_pages(struct gntdev_dmabuf_export_args *args)
383386
exp_info.priv = gntdev_dmabuf;
384387

385388
gntdev_dmabuf->dmabuf = dma_buf_export(&exp_info);
386-
if (IS_ERR(gntdev_dmabuf->dmabuf)) {
387-
ret = PTR_ERR(gntdev_dmabuf->dmabuf);
388-
gntdev_dmabuf->dmabuf = NULL;
389-
goto fail;
390-
}
391-
392-
ret = dma_buf_fd(gntdev_dmabuf->dmabuf, O_CLOEXEC);
393-
if (ret < 0)
394-
goto fail;
389+
if (IS_ERR(gntdev_dmabuf->dmabuf))
390+
return PTR_ERR(gntdev_dmabuf->dmabuf);
395391

396392
gntdev_dmabuf->fd = ret;
397393
args->fd = ret;
398394

399395
pr_debug("Exporting DMA buffer with fd %d\n", ret);
400396

397+
get_file(gntdev_dmabuf->priv->filp);
401398
mutex_lock(&args->dmabuf_priv->lock);
402399
list_add(&gntdev_dmabuf->next, &args->dmabuf_priv->exp_list);
403400
mutex_unlock(&args->dmabuf_priv->lock);
404-
get_file(gntdev_dmabuf->priv->filp);
405-
return 0;
406401

407-
fail:
408-
if (gntdev_dmabuf->dmabuf)
409-
dma_buf_put(gntdev_dmabuf->dmabuf);
410-
kfree(gntdev_dmabuf);
411-
return ret;
402+
fd_install(take_fd(ret), no_free_ptr(gntdev_dmabuf)->dmabuf->file);
403+
return 0;
412404
}
413405

414406
static struct gntdev_grant_map *

‎drivers/xen/gntdev.c

Lines changed: 50 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,18 @@ MODULE_AUTHOR("Derek G. Murray <[email protected]>, "
5656
"Gerd Hoffmann <[email protected]>");
5757
MODULE_DESCRIPTION("User-space granted page access driver");
5858

59+
#define GNTDEV_COPY_BATCH 16
60+
61+
struct gntdev_copy_batch {
62+
struct gnttab_copy ops[GNTDEV_COPY_BATCH];
63+
struct page *pages[GNTDEV_COPY_BATCH];
64+
s16 __user *status[GNTDEV_COPY_BATCH];
65+
unsigned int nr_ops;
66+
unsigned int nr_pages;
67+
bool writeable;
68+
struct gntdev_copy_batch *next;
69+
};
70+
5971
static unsigned int limit = 64*1024;
6072
module_param(limit, uint, 0644);
6173
MODULE_PARM_DESC(limit,
@@ -584,6 +596,8 @@ static int gntdev_open(struct inode *inode, struct file *flip)
584596
INIT_LIST_HEAD(&priv->maps);
585597
mutex_init(&priv->lock);
586598

599+
mutex_init(&priv->batch_lock);
600+
587601
#ifdef CONFIG_XEN_GNTDEV_DMABUF
588602
priv->dmabuf_priv = gntdev_dmabuf_init(flip);
589603
if (IS_ERR(priv->dmabuf_priv)) {
@@ -608,6 +622,7 @@ static int gntdev_release(struct inode *inode, struct file *flip)
608622
{
609623
struct gntdev_priv *priv = flip->private_data;
610624
struct gntdev_grant_map *map;
625+
struct gntdev_copy_batch *batch;
611626

612627
pr_debug("priv %p\n", priv);
613628

@@ -620,6 +635,14 @@ static int gntdev_release(struct inode *inode, struct file *flip)
620635
}
621636
mutex_unlock(&priv->lock);
622637

638+
mutex_lock(&priv->batch_lock);
639+
while (priv->batch) {
640+
batch = priv->batch;
641+
priv->batch = batch->next;
642+
kfree(batch);
643+
}
644+
mutex_unlock(&priv->batch_lock);
645+
623646
#ifdef CONFIG_XEN_GNTDEV_DMABUF
624647
gntdev_dmabuf_fini(priv->dmabuf_priv);
625648
#endif
@@ -785,17 +808,6 @@ static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u)
785808
return rc;
786809
}
787810

788-
#define GNTDEV_COPY_BATCH 16
789-
790-
struct gntdev_copy_batch {
791-
struct gnttab_copy ops[GNTDEV_COPY_BATCH];
792-
struct page *pages[GNTDEV_COPY_BATCH];
793-
s16 __user *status[GNTDEV_COPY_BATCH];
794-
unsigned int nr_ops;
795-
unsigned int nr_pages;
796-
bool writeable;
797-
};
798-
799811
static int gntdev_get_page(struct gntdev_copy_batch *batch, void __user *virt,
800812
unsigned long *gfn)
801813
{
@@ -953,36 +965,53 @@ static int gntdev_grant_copy_seg(struct gntdev_copy_batch *batch,
953965
static long gntdev_ioctl_grant_copy(struct gntdev_priv *priv, void __user *u)
954966
{
955967
struct ioctl_gntdev_grant_copy copy;
956-
struct gntdev_copy_batch batch;
968+
struct gntdev_copy_batch *batch;
957969
unsigned int i;
958970
int ret = 0;
959971

960972
if (copy_from_user(&copy, u, sizeof(copy)))
961973
return -EFAULT;
962974

963-
batch.nr_ops = 0;
964-
batch.nr_pages = 0;
975+
mutex_lock(&priv->batch_lock);
976+
if (!priv->batch) {
977+
batch = kmalloc(sizeof(*batch), GFP_KERNEL);
978+
} else {
979+
batch = priv->batch;
980+
priv->batch = batch->next;
981+
}
982+
mutex_unlock(&priv->batch_lock);
983+
if (!batch)
984+
return -ENOMEM;
985+
986+
batch->nr_ops = 0;
987+
batch->nr_pages = 0;
965988

966989
for (i = 0; i < copy.count; i++) {
967990
struct gntdev_grant_copy_segment seg;
968991

969992
if (copy_from_user(&seg, &copy.segments[i], sizeof(seg))) {
970993
ret = -EFAULT;
994+
gntdev_put_pages(batch);
971995
goto out;
972996
}
973997

974-
ret = gntdev_grant_copy_seg(&batch, &seg, &copy.segments[i].status);
975-
if (ret < 0)
998+
ret = gntdev_grant_copy_seg(batch, &seg, &copy.segments[i].status);
999+
if (ret < 0) {
1000+
gntdev_put_pages(batch);
9761001
goto out;
1002+
}
9771003

9781004
cond_resched();
9791005
}
980-
if (batch.nr_ops)
981-
ret = gntdev_copy(&batch);
982-
return ret;
1006+
if (batch->nr_ops)
1007+
ret = gntdev_copy(batch);
1008+
1009+
out:
1010+
mutex_lock(&priv->batch_lock);
1011+
batch->next = priv->batch;
1012+
priv->batch = batch;
1013+
mutex_unlock(&priv->batch_lock);
9831014

984-
out:
985-
gntdev_put_pages(&batch);
9861015
return ret;
9871016
}
9881017

‎drivers/xen/manage.c

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,6 @@ void xen_resume_notifier_register(struct notifier_block *nb)
5252
}
5353
EXPORT_SYMBOL_GPL(xen_resume_notifier_register);
5454

55-
void xen_resume_notifier_unregister(struct notifier_block *nb)
56-
{
57-
raw_notifier_chain_unregister(&xen_resume_notifier, nb);
58-
}
59-
EXPORT_SYMBOL_GPL(xen_resume_notifier_unregister);
60-
6155
#ifdef CONFIG_HIBERNATE_CALLBACKS
6256
static int xen_suspend(void *data)
6357
{

‎drivers/xen/time.c

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -136,14 +136,6 @@ void xen_manage_runstate_time(int action)
136136
}
137137
}
138138

139-
/*
140-
* Runstate accounting
141-
*/
142-
void xen_get_runstate_snapshot(struct vcpu_runstate_info *res)
143-
{
144-
xen_get_runstate_snapshot_cpu(res, smp_processor_id());
145-
}
146-
147139
/* return true when a vcpu could run but has no real cpu to run on */
148140
bool xen_vcpu_stolen(int vcpu)
149141
{

‎drivers/xen/xen-pciback/pci_stub.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1261,7 +1261,7 @@ static ssize_t slots_show(struct device_driver *drv, char *buf)
12611261
if (count >= PAGE_SIZE)
12621262
break;
12631263

1264-
count += scnprintf(buf + count, PAGE_SIZE - count,
1264+
count += sysfs_emit_at(buf, count,
12651265
"%04x:%02x:%02x.%d\n",
12661266
pci_dev_id->domain, pci_dev_id->bus,
12671267
PCI_SLOT(pci_dev_id->devfn),
@@ -1290,7 +1290,7 @@ static ssize_t irq_handlers_show(struct device_driver *drv, char *buf)
12901290
if (!dev_data)
12911291
continue;
12921292
count +=
1293-
scnprintf(buf + count, PAGE_SIZE - count,
1293+
sysfs_emit_at(buf, count,
12941294
"%s:%s:%sing:%ld\n",
12951295
pci_name(psdev->dev),
12961296
dev_data->isr_on ? "on" : "off",
@@ -1375,7 +1375,7 @@ static ssize_t quirks_show(struct device_driver *drv, char *buf)
13751375
if (count >= PAGE_SIZE)
13761376
goto out;
13771377

1378-
count += scnprintf(buf + count, PAGE_SIZE - count,
1378+
count += sysfs_emit_at(buf, count,
13791379
"%02x:%02x.%01x\n\t%04x:%04x:%04x:%04x\n",
13801380
quirk->pdev->bus->number,
13811381
PCI_SLOT(quirk->pdev->devfn),
@@ -1391,7 +1391,7 @@ static ssize_t quirks_show(struct device_driver *drv, char *buf)
13911391
if (count >= PAGE_SIZE)
13921392
goto out;
13931393

1394-
count += scnprintf(buf + count, PAGE_SIZE - count,
1394+
count += sysfs_emit_at(buf, count,
13951395
"\t\t%08x:%01x:%08x\n",
13961396
cfg_entry->base_offset +
13971397
field->offset, field->size,
@@ -1462,7 +1462,7 @@ static ssize_t permissive_show(struct device_driver *drv, char *buf)
14621462
if (!dev_data || !dev_data->permissive)
14631463
continue;
14641464
count +=
1465-
scnprintf(buf + count, PAGE_SIZE - count, "%s\n",
1465+
sysfs_emit_at(buf, count, "%s\n",
14661466
pci_name(psdev->dev));
14671467
}
14681468
spin_unlock_irqrestore(&pcistub_devices_lock, flags);
@@ -1521,7 +1521,7 @@ static ssize_t allow_interrupt_control_show(struct device_driver *drv,
15211521
if (!dev_data || !dev_data->allow_interrupt_control)
15221522
continue;
15231523
count +=
1524-
scnprintf(buf + count, PAGE_SIZE - count, "%s\n",
1524+
sysfs_emit_at(buf, count, "%s\n",
15251525
pci_name(psdev->dev));
15261526
}
15271527
spin_unlock_irqrestore(&pcistub_devices_lock, flags);

‎drivers/xen/xenbus/xenbus_client.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ int xenbus_watch_pathfmt(struct xenbus_device *dev,
202202
}
203203
EXPORT_SYMBOL_GPL(xenbus_watch_pathfmt);
204204

205+
__printf(4, 5)
205206
static void xenbus_switch_fatal(struct xenbus_device *, int, int,
206207
const char *, ...);
207208

@@ -287,6 +288,7 @@ int xenbus_frontend_closed(struct xenbus_device *dev)
287288
}
288289
EXPORT_SYMBOL_GPL(xenbus_frontend_closed);
289290

291+
__printf(3, 0)
290292
static void xenbus_va_dev_error(struct xenbus_device *dev, int err,
291293
const char *fmt, va_list ap)
292294
{

‎drivers/xen/xenbus/xenbus_xs.c

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -512,23 +512,6 @@ int xenbus_write(struct xenbus_transaction t,
512512
}
513513
EXPORT_SYMBOL_GPL(xenbus_write);
514514

515-
/* Create a new directory. */
516-
int xenbus_mkdir(struct xenbus_transaction t,
517-
const char *dir, const char *node)
518-
{
519-
char *path;
520-
int ret;
521-
522-
path = join(dir, node);
523-
if (IS_ERR(path))
524-
return PTR_ERR(path);
525-
526-
ret = xs_error(xs_single(t, XS_MKDIR, path, NULL));
527-
kfree(path);
528-
return ret;
529-
}
530-
EXPORT_SYMBOL_GPL(xenbus_mkdir);
531-
532515
/* Destroy a file or directory (directories must be empty). */
533516
int xenbus_rm(struct xenbus_transaction t, const char *dir, const char *node)
534517
{

‎include/xen/xen-ops.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,11 @@ void xen_arch_suspend(void);
3030
void xen_reboot(int reason);
3131

3232
void xen_resume_notifier_register(struct notifier_block *nb);
33-
void xen_resume_notifier_unregister(struct notifier_block *nb);
3433

3534
bool xen_vcpu_stolen(int vcpu);
3635
void xen_setup_runstate_info(int cpu);
3736
void xen_time_setup_guest(void);
3837
void xen_manage_runstate_time(int action);
39-
void xen_get_runstate_snapshot(struct vcpu_runstate_info *res);
4038
u64 xen_steal_clock(int cpu);
4139

4240
int xen_setup_shutdown_event(void);

0 commit comments

Comments
 (0)