kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

xen: apply XSA-236

Browse source 
Approved by:	bapt (implicit)
MFH:		2017Q4
Sponsored by:	Citrix Systems R&D
This commit is contained in:
Roger Pau Monné 2017-10-24 14:11:22 +00:00
parent 13dfd174f4
commit 26386f00eb
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=452769
2 changed files with 69 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
emulators/xen-kernel/Makefile
View file

@ -2,7 +2,7 @@
PORTNAME= xen
PORTVERSION= 4.7.2
PORTREVISION= 6
PORTREVISION= 7
CATEGORIES= emulators
MASTER_SITES= http://downloads.xenproject.org/release/xen/${PORTVERSION}/
PKGNAMESUFFIX= -kernel
@ -80,7 +80,8 @@ EXTRA_PATCHES= ${FILESDIR}/0001-xen-logdirty-prevent-preemption-if-finished.patc
${FILESDIR}/xsa241-4.8.patch:-p1 \
${FILESDIR}/xsa242-4.9.patch:-p1 \
${FILESDIR}/xsa243-4.7.patch:-p1 \
${FILESDIR}/xsa244-4.7.patch:-p1
${FILESDIR}/xsa244-4.7.patch:-p1 \
${FILESDIR}/xsa236-4.9.patch:-p1
.include <bsd.port.options.mk>

66
emulators/xen-kernel/files/xsa236-4.9.patch Normal file
View file

@ -0,0 +1,66 @@
From: Jan Beulich <jbeulich@suse.com>
Subject: gnttab: fix pin count / page reference race
Dropping page references before decrementing pin counts is a bad idea
if assumptions are being made that a non-zero pin count implies a valid
page. Fix the order of operations in gnttab_copy_release_buf(), but at
the same time also remove the assertion that was found to trigger:
map_grant_ref() also has the potential of causing a race here, and
changing the order of operations there would likely be quite a bit more
involved.
This is XSA-236.
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -2330,9 +2330,20 @@ __acquire_grant_for_copy(
td = page_get_owner_and_reference(*page);
/*
* act->pin being non-zero should guarantee the page to have a
- * non-zero refcount and hence a valid owner.
+ * non-zero refcount and hence a valid owner (matching the one on
+ * record), with one exception: If the owning domain is dying we
+ * had better not make implications from pin count (map_grant_ref()
+ * updates pin counts before obtaining page references, for
+ * example).
*/
- ASSERT(td);
+ if ( td != rd || rd->is_dying )
+ {
+ if ( td )
+ put_page(*page);
+ *page = NULL;
+ rc = GNTST_bad_domain;
+ goto unlock_out_clear;
+ }
}
act->pin += readonly ? GNTPIN_hstr_inc : GNTPIN_hstw_inc;
@@ -2451,6 +2462,11 @@ static void gnttab_copy_release_buf(stru
unmap_domain_page(buf->virt);
buf->virt = NULL;
}
+ if ( buf->have_grant )
+ {
+ __release_grant_for_copy(buf->domain, buf->ptr.u.ref, buf->read_only);
+ buf->have_grant = 0;
+ }
if ( buf->have_type )
{
put_page_type(buf->page);
@@ -2461,11 +2477,6 @@ static void gnttab_copy_release_buf(stru
put_page(buf->page);
buf->page = NULL;
}
- if ( buf->have_grant )
- {
- __release_grant_for_copy(buf->domain, buf->ptr.u.ref, buf->read_only);
- buf->have_grant = 0;
- }
}
static int gnttab_copy_claim_buf(const struct gnttab_copy *op,