8724a18868
config handling stack overflow 55a62eb0-xl-correct-handling-of-extra_config-in-main_cpupoolcreate.patch - bsc#907514 - Bus fatal error & sles12 sudden reboot has been observed - bsc#910258 - SLES12 Xen host crashes with FATAL NMI after shutdown of guest with VT-d NIC - bsc#918984 - Bus fatal error & sles11-SP4 sudden reboot has been observed - bsc#923967 - Partner-L3: Bus fatal error & sles11-SP3 sudden reboot has been observed 552d293b-x86-vMSI-X-honor-all-mask-requests.patch 552d2966-x86-vMSI-X-add-valid-bits-for-read-acceleration.patch 5576f143-x86-adjust-PV-I-O-emulation-functions-types.patch 55795a52-x86-vMSI-X-support-qword-MMIO-access.patch 5583d9c5-x86-MSI-X-cleanup.patch 5583da09-x86-MSI-track-host-and-guest-masking-separately.patch 55b0a218-x86-PCI-CFG-write-intercept.patch 55b0a255-x86-MSI-X-maskall.patch 55b0a283-x86-MSI-X-teardown.patch 55b0a2ab-x86-MSI-X-enable.patch 55b0a2db-x86-MSI-track-guest-masking.patch - Upstream patches from Jan 552d0f49-x86-traps-identify-the-vcpu-in-context-when-dumping-regs.patch 559bc633-x86-cpupool-clear-proper-cpu_valid-bit-on-CPU-teardown.patch 559bc64e-credit1-properly-deal-with-CPUs-not-in-any-pool.patch 559bc87f-x86-hvmloader-avoid-data-corruption-with-xenstore-rw.patch 55a66a1e-make-rangeset_report_ranges-report-all-ranges.patch 55a77e4f-dmar-device-scope-mem-leak-fix.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=373
69 lines
2.3 KiB
Diff
69 lines
2.3 KiB
Diff
# Commit bbbe7e7157a964c485fb861765be291734676932
|
|
# Date 2015-07-07 14:39:27 +0200
|
|
# Author Andrew Cooper <andrew.cooper3@citrix.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/hvmloader: avoid data corruption with xenstore reads/writes
|
|
|
|
The functions ring_read and ring_write() have logic to try and deal with
|
|
partial reads and writes.
|
|
|
|
However, in all cases where the "while (len)" loop executed twice, data
|
|
corruption would occur as the second memcpy() starts from the beginning of
|
|
"data" again, rather than from where it got to.
|
|
|
|
This bug manifested itself as protocol corruption when a reply header crossed
|
|
the first wrap of the response ring. However, similar corruption would also
|
|
occur if hvmloader observed xenstored performing partial writes of the block
|
|
in question, or if hvmloader had to wait for xenstored to make space in either
|
|
ring.
|
|
|
|
Reported-by: Adam Kucia <djexit@o2.pl>
|
|
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
|
|
--- a/tools/firmware/hvmloader/xenbus.c
|
|
+++ b/tools/firmware/hvmloader/xenbus.c
|
|
@@ -105,7 +105,7 @@ void xenbus_shutdown(void)
|
|
/* Helper functions: copy data in and out of the ring */
|
|
static void ring_write(const char *data, uint32_t len)
|
|
{
|
|
- uint32_t part;
|
|
+ uint32_t part, done = 0;
|
|
|
|
ASSERT(len <= XENSTORE_PAYLOAD_MAX);
|
|
|
|
@@ -122,16 +122,18 @@ static void ring_write(const char *data,
|
|
if ( part > len )
|
|
part = len;
|
|
|
|
- memcpy(rings->req + MASK_XENSTORE_IDX(rings->req_prod), data, part);
|
|
+ memcpy(rings->req + MASK_XENSTORE_IDX(rings->req_prod),
|
|
+ data + done, part);
|
|
barrier(); /* = wmb before prod write, rmb before next cons read */
|
|
rings->req_prod += part;
|
|
len -= part;
|
|
+ done += part;
|
|
}
|
|
}
|
|
|
|
static void ring_read(char *data, uint32_t len)
|
|
{
|
|
- uint32_t part;
|
|
+ uint32_t part, done = 0;
|
|
|
|
ASSERT(len <= XENSTORE_PAYLOAD_MAX);
|
|
|
|
@@ -148,10 +150,12 @@ static void ring_read(char *data, uint32
|
|
if ( part > len )
|
|
part = len;
|
|
|
|
- memcpy(data, rings->rsp + MASK_XENSTORE_IDX(rings->rsp_cons), part);
|
|
+ memcpy(data + done,
|
|
+ rings->rsp + MASK_XENSTORE_IDX(rings->rsp_cons), part);
|
|
barrier(); /* = wmb before cons write, rmb before next prod read */
|
|
rings->rsp_cons += part;
|
|
len -= part;
|
|
+ done += part;
|
|
}
|
|
}
|
|
|