Pull xen fixes from Juergen Gross: "Fixes and simple cleanups: - use a proper flexible array instead of a one-element array in order to avoid array-bounds sanitizer errors - add NULL pointer checks after allocating memory - use memdup_array_user() instead of open-coding it - fix a rare race condition in Xen event channel allocation code - make struct bus_type instances const - make kerneldoc inline comments match reality" * tag 'for-linus-6.8a-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/events: close evtchn after mapping cleanup xen/gntalloc: Replace UAPI 1-element array xen: balloon: make balloon_subsys const xen: pcpu: make xen_pcpu_subsys const xen/privcmd: Use memdup_array_user() in alloc_ioreq() x86/xen: Add some null pointer checking to smp.c xen/xenbus: document will_handle argument for xenbus_watch_path()
Unified · Split
| @@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) · 64 unmodified lines | ||
| 65 | 65 | char *resched_name, *callfunc_name, *debug_name; |
| 66 | 66 | |
| 67 | 67 | resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); |
| 68 | + if (!resched_name) | |
| 69 | + goto fail_mem; | |
| 68 | 70 | per_cpu(xen_resched_irq, cpu).name = resched_name; |
| 69 | 71 | rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, |
| 70 | 72 | cpu, |
| @@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) · 6 unmodified lines | ||
| 77 | 79 | per_cpu(xen_resched_irq, cpu).irq = rc; |
| 78 | 80 | |
| 79 | 81 | callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); |
| 82 | + if (!callfunc_name) | |
| 83 | + goto fail_mem; | |
| 80 | 84 | per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; |
| 81 | 85 | rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, |
| 82 | 86 | cpu, |
| @@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) · 7 unmodified lines | ||
| 90 | 94 | |
| 91 | 95 | if (!xen_fifo_events) { |
| 92 | 96 | debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); |
| 97 | + if (!debug_name) | |
| 98 | + goto fail_mem; | |
| 99 | + | |
| 93 | 100 | per_cpu(xen_debug_irq, cpu).name = debug_name; |
| 94 | 101 | rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, |
| 95 | 102 | xen_debug_interrupt, |
| @@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) · 5 unmodified lines | ||
| 101 | 108 | } |
| 102 | 109 | |
| 103 | 110 | callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); |
| 111 | + if (!callfunc_name) | |
| 112 | + goto fail_mem; | |
| 113 | + | |
| 104 | 114 | per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; |
| 105 | 115 | rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, |
| 106 | 116 | cpu, |
| @@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) · 7 unmodified lines | ||
| 114 | 124 | |
| 115 | 125 | return 0; |
| 116 | 126 | |
| 127 | + fail_mem: | |
| 128 | + rc = -ENOMEM; | |
| 117 | 129 | fail: |
| 118 | 130 | xen_smp_intr_free(cpu); |
| 119 | 131 | return rc; |
| @@ -923,8 +923,8 @@ static void shutdown_pirq(struct irq_data *data) · 922 unmodified lines | ||
| 923 | 923 | return; |
| 924 | 924 | |
| 925 | 925 | do_mask(info, EVT_MASK_REASON_EXPLICIT); |
| 926 | − xen_evtchn_close(evtchn); | |
| 927 | 926 | xen_irq_info_cleanup(info); |
| 927 | + xen_evtchn_close(evtchn); | |
| 928 | 928 | } |
| 929 | 929 | |
| 930 | 930 | static void enable_pirq(struct irq_data *data) |
| @@ -956,6 +956,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); · 25 unmodified lines | ||
| 956 | 956 | static void __unbind_from_irq(struct irq_info *info, unsigned int irq) |
| 957 | 957 | { |
| 958 | 958 | evtchn_port_t evtchn; |
| 959 | + bool close_evtchn = false; | |
| 959 | 960 | |
| 960 | 961 | if (!info) { |
| 961 | 962 | xen_irq_free_desc(irq); |
| @@ -975,7 +976,7 @@ static void __unbind_from_irq(struct irq_info *info, unsigned int irq) · 13 unmodified lines | ||
| 975 | 976 | struct xenbus_device *dev; |
| 976 | 977 | |
| 977 | 978 | if (!info->is_static) |
| 978 | − xen_evtchn_close(evtchn); | |
| 979 | + close_evtchn = true; | |
| 979 | 980 | |
| 980 | 981 | switch (info->type) { |
| 981 | 982 | case IRQT_VIRQ: |
| @@ -995,6 +996,9 @@ static void __unbind_from_irq(struct irq_info *info, unsigned int irq) · 13 unmodified lines | ||
| 995 | 996 | } |
| 996 | 997 | |
| 997 | 998 | xen_irq_info_cleanup(info); |
| 999 | + | |
| 1000 | + if (close_evtchn) | |
| 1001 | + xen_evtchn_close(evtchn); | |
| 998 | 1002 | } |
| 999 | 1003 | |
| 1000 | 1004 | xen_free_irq(info); |
| @@ -317,7 +317,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv, · 316 unmodified lines | ||
| 317 | 317 | rc = -EFAULT; |
| 318 | 318 | goto out_free; |
| 319 | 319 | } |
| 320 | − if (copy_to_user(arg->gref_ids, gref_ids, | |
| 320 | + if (copy_to_user(arg->gref_ids_flex, gref_ids, | |
| 321 | 321 | sizeof(gref_ids[0]) * op.count)) { |
| 322 | 322 | rc = -EFAULT; |
| 323 | 323 | goto out_free; |
| @@ -65,7 +65,7 @@ struct pcpu { · 64 unmodified lines | ||
| 65 | 65 | uint32_t flags; |
| 66 | 66 | }; |
| 67 | 67 | |
| 68 | −static struct bus_type xen_pcpu_subsys = { | |
| 68 | +static const struct bus_type xen_pcpu_subsys = { | |
| 69 | 69 | .name = "xen_cpu", |
| 70 | 70 | .dev_name = "xen_cpu", |
| 71 | 71 | }; |
| @@ -1223,18 +1223,13 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd) · 1222 unmodified lines | ||
| 1223 | 1223 | kioreq->ioreq = (struct ioreq *)(page_to_virt(pages[0])); |
| 1224 | 1224 | mmap_write_unlock(mm); |
| 1225 | 1225 | |
| 1226 | − size = sizeof(*ports) * kioreq->vcpus; | |
| 1227 | − ports = kzalloc(size, GFP_KERNEL); | |
| 1228 | − if (!ports) { | |
| 1229 | − ret = -ENOMEM; | |
| 1226 | + ports = memdup_array_user(u64_to_user_ptr(ioeventfd->ports), | |
| 1227 | + kioreq->vcpus, sizeof(*ports)); | |
| 1228 | + if (IS_ERR(ports)) { | |
| 1229 | + ret = PTR_ERR(ports); | |
| 1230 | 1230 | goto error_kfree; |
| 1231 | 1231 | } |
| 1232 | 1232 | |
| 1233 | − if (copy_from_user(ports, u64_to_user_ptr(ioeventfd->ports), size)) { | |
| 1234 | − ret = -EFAULT; | |
| 1235 | − goto error_kfree_ports; | |
| 1236 | − } | |
| 1237 | − | |
| 1238 | 1233 | for (i = 0; i < kioreq->vcpus; i++) { |
| 1239 | 1234 | kioreq->ports[i].vcpu = i; |
| 1240 | 1235 | kioreq->ports[i].port = ports[i]; |
| @@ -1256,7 +1251,7 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd) · 15 unmodified lines | ||
| 1256 | 1251 | error_unbind: |
| 1257 | 1252 | while (--i >= 0) |
| 1258 | 1253 | unbind_from_irqhandler(irq_from_evtchn(ports[i]), &kioreq->ports[i]); |
| 1259 | −error_kfree_ports: | |
| 1254 | + | |
| 1260 | 1255 | kfree(ports); |
| 1261 | 1256 | error_kfree: |
| 1262 | 1257 | kfree(kioreq); |
| @@ -237,7 +237,7 @@ static const struct attribute_group *balloon_groups[] = { · 236 unmodified lines | ||
| 237 | 237 | NULL |
| 238 | 238 | }; |
| 239 | 239 | |
| 240 | −static struct bus_type balloon_subsys = { | |
| 240 | +static const struct bus_type balloon_subsys = { | |
| 241 | 241 | .name = BALLOON_CLASS_NAME, |
| 242 | 242 | .dev_name = BALLOON_CLASS_NAME, |
| 243 | 243 | }; |
| @@ -116,14 +116,15 @@ EXPORT_SYMBOL_GPL(xenbus_strstate); · 115 unmodified lines | ||
| 116 | 116 | * @dev: xenbus device |
| 117 | 117 | * @path: path to watch |
| 118 | 118 | * @watch: watch to register |
| 119 | + * @will_handle: events queuing determine callback | |
| 119 | 120 | * @callback: callback to register |
| 120 | 121 | * |
| 121 | 122 | * Register a @watch on the given path, using the given xenbus_watch structure |
| 122 | − * for storage, and the given @callback function as the callback. On success, | |
| 123 | − * the given @path will be saved as @watch->node, and remains the | |
| 124 | − * caller's to free. On error, @watch->node will | |
| 125 | − * be NULL, the device will switch to %XenbusStateClosing, and the error will | |
| 126 | − * be saved in the store. | |
| 123 | + * for storage, @will_handle function as the callback to determine if each | |
| 124 | + * event need to be queued, and the given @callback function as the callback. | |
| 125 | + * On success, the given @path will be saved as @watch->node, and remains the | |
| 126 | + * caller's to free. On error, @watch->node will be NULL, the device will | |
| 127 | + * switch to %XenbusStateClosing, and the error will be saved in the store. | |
| 127 | 128 | * |
| 128 | 129 | * Returns: %0 on success or -errno on error |
| 129 | 130 | */ |
| @@ -158,11 +159,13 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path); · 28 unmodified lines | ||
| 158 | 159 | * xenbus_watch_pathfmt - register a watch on a sprintf-formatted path |
| 159 | 160 | * @dev: xenbus device |
| 160 | 161 | * @watch: watch to register |
| 162 | + * @will_handle: events queuing determine callback | |
| 161 | 163 | * @callback: callback to register |
| 162 | 164 | * @pathfmt: format of path to watch |
| 163 | 165 | * |
| 164 | 166 | * Register a watch on the given @path, using the given xenbus_watch |
| 165 | − * structure for storage, and the given @callback function as the | |
| 167 | + * structure for storage, @will_handle function as the callback to determine if | |
| 168 | + * each event need to be queued, and the given @callback function as the | |
| 166 | 169 | * callback. On success, the watched path (@path/@path2) will be saved |
| 167 | 170 | * as @watch->node, and becomes the caller's to kfree(). |
| 168 | 171 | * On error, watch->node will be NULL, so the caller has nothing to |
| @@ -31,7 +31,10 @@ struct ioctl_gntalloc_alloc_gref { · 30 unmodified lines | ||
| 31 | 31 | __u64 index; |
| 32 | 32 | /* The grant references of the newly created grant, one per page */ |
| 33 | 33 | /* Variable size, depending on count */ |
| 34 | − __u32 gref_ids[1]; | |
| 34 | + union { | |
| 35 | + __u32 gref_ids[1]; | |
| 36 | + __DECLARE_FLEX_ARRAY(__u32, gref_ids_flex); | |
| 37 | + }; | |
| 35 | 38 | }; |
| 36 | 39 | |
| 37 | 40 | #define GNTALLOC_FLAG_WRITABLE 1 |