History

Merge tag 'for-linus-6.8a-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross: "Fixes and simple cleanups: - use a proper flexible array instead of a one-element array in order to avoid array-bounds sanitizer errors - add NULL pointer checks after allocating memory - use memdup_array_user() instead of open-coding it - fix a rare race condition in Xen event channel allocation code - make struct bus_type instances const - make kerneldoc inline comments match reality" * tag 'for-linus-6.8a-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/events: close evtchn after mapping cleanup xen/gntalloc: Replace UAPI 1-element array xen: balloon: make balloon_subsys const xen: pcpu: make xen_pcpu_subsys const xen/privcmd: Use memdup_array_user() in alloc_ioreq() x86/xen: Add some null pointer checking to smp.c xen/xenbus: document will_handle argument for xenbus_watch_path()

Linus Torvalds committed 2 years ago

Commit cc9c4f02 parents 68fb3ca fa765c48 files · +39 −22Browse files

Unified · Split

8 files
  1. arch/x86/xen/smp.c +12 −0
  2. drivers/xen/events/events_base.c +6 −2
  3. drivers/xen/gntalloc.c +1 −1
  4. drivers/xen/pcpu.c +1 −1
  5. drivers/xen/privcmd.c +5 −10
  6. drivers/xen/xen-balloon.c +1 −1
  7. drivers/xen/xenbus/xenbus_client.c +9 −6
  8. include/uapi/xen/gntalloc.h +4 −1
arch/x86/xen/smp.c+12−0
@@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) · 64 unmodified lines
65 char *resched_name, *callfunc_name, *debug_name;65 char *resched_name, *callfunc_name, *debug_name;
66 66
67 resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu);67 resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu);
68 if (!resched_name)
69 goto fail_mem;
68 per_cpu(xen_resched_irq, cpu).name = resched_name;70 per_cpu(xen_resched_irq, cpu).name = resched_name;
69 rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR,71 rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR,
70 cpu,72 cpu,
@@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) · 6 unmodified lines
77 per_cpu(xen_resched_irq, cpu).irq = rc;79 per_cpu(xen_resched_irq, cpu).irq = rc;
78 80
79 callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu);81 callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu);
82 if (!callfunc_name)
83 goto fail_mem;
80 per_cpu(xen_callfunc_irq, cpu).name = callfunc_name;84 per_cpu(xen_callfunc_irq, cpu).name = callfunc_name;
81 rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR,85 rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR,
82 cpu,86 cpu,
@@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) · 7 unmodified lines
90 94
91 if (!xen_fifo_events) {95 if (!xen_fifo_events) {
92 debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu);96 debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu);
97 if (!debug_name)
98 goto fail_mem;
99
93 per_cpu(xen_debug_irq, cpu).name = debug_name;100 per_cpu(xen_debug_irq, cpu).name = debug_name;
94 rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu,101 rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu,
95 xen_debug_interrupt,102 xen_debug_interrupt,
@@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) · 5 unmodified lines
101 }108 }
102 109
103 callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu);110 callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu);
111 if (!callfunc_name)
112 goto fail_mem;
113
104 per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name;114 per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name;
105 rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR,115 rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR,
106 cpu,116 cpu,
@@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) · 7 unmodified lines
114 124
115 return 0;125 return 0;
116 126
127 fail_mem:
128 rc = -ENOMEM;
117 fail:129 fail:
118 xen_smp_intr_free(cpu);130 xen_smp_intr_free(cpu);
119 return rc;131 return rc;
drivers/xen/events/events_base.c+6−2
@@ -923,8 +923,8 @@ static void shutdown_pirq(struct irq_data *data) · 922 unmodified lines
923 return;923 return;
924 924
925 do_mask(info, EVT_MASK_REASON_EXPLICIT);925 do_mask(info, EVT_MASK_REASON_EXPLICIT);
926 xen_evtchn_close(evtchn);
927 xen_irq_info_cleanup(info);926 xen_irq_info_cleanup(info);
927 xen_evtchn_close(evtchn);
928}928}
929 929
930static void enable_pirq(struct irq_data *data)930static void enable_pirq(struct irq_data *data)
@@ -956,6 +956,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); · 25 unmodified lines
956static void __unbind_from_irq(struct irq_info *info, unsigned int irq)956static void __unbind_from_irq(struct irq_info *info, unsigned int irq)
957{957{
958 evtchn_port_t evtchn;958 evtchn_port_t evtchn;
959 bool close_evtchn = false;
959 960
960 if (!info) {961 if (!info) {
961 xen_irq_free_desc(irq);962 xen_irq_free_desc(irq);
@@ -975,7 +976,7 @@ static void __unbind_from_irq(struct irq_info *info, unsigned int irq) · 13 unmodified lines
975 struct xenbus_device *dev;976 struct xenbus_device *dev;
976 977
977 if (!info->is_static)978 if (!info->is_static)
978 xen_evtchn_close(evtchn);979 close_evtchn = true;
979 980
980 switch (info->type) {981 switch (info->type) {
981 case IRQT_VIRQ:982 case IRQT_VIRQ:
@@ -995,6 +996,9 @@ static void __unbind_from_irq(struct irq_info *info, unsigned int irq) · 13 unmodified lines
995 }996 }
996 997
997 xen_irq_info_cleanup(info);998 xen_irq_info_cleanup(info);
999
1000 if (close_evtchn)
1001 xen_evtchn_close(evtchn);
998 }1002 }
999 1003
1000 xen_free_irq(info);1004 xen_free_irq(info);
drivers/xen/gntalloc.c+1−1
@@ -317,7 +317,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv, · 316 unmodified lines
317 rc = -EFAULT;317 rc = -EFAULT;
318 goto out_free;318 goto out_free;
319 }319 }
320 if (copy_to_user(arg->gref_ids, gref_ids,320 if (copy_to_user(arg->gref_ids_flex, gref_ids,
321 sizeof(gref_ids[0]) * op.count)) {321 sizeof(gref_ids[0]) * op.count)) {
322 rc = -EFAULT;322 rc = -EFAULT;
323 goto out_free;323 goto out_free;
drivers/xen/pcpu.c+1−1
@@ -65,7 +65,7 @@ struct pcpu { · 64 unmodified lines
65 uint32_t flags;65 uint32_t flags;
66};66};
67 67
68static struct bus_type xen_pcpu_subsys = {68static const struct bus_type xen_pcpu_subsys = {
69 .name = "xen_cpu",69 .name = "xen_cpu",
70 .dev_name = "xen_cpu",70 .dev_name = "xen_cpu",
71};71};
drivers/xen/privcmd.c+5−10
@@ -1223,18 +1223,13 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd) · 1222 unmodified lines
1223 kioreq->ioreq = (struct ioreq *)(page_to_virt(pages[0]));1223 kioreq->ioreq = (struct ioreq *)(page_to_virt(pages[0]));
1224 mmap_write_unlock(mm);1224 mmap_write_unlock(mm);
1225 1225
1226 size = sizeof(*ports) * kioreq->vcpus;1226 ports = memdup_array_user(u64_to_user_ptr(ioeventfd->ports),
1227 ports = kzalloc(size, GFP_KERNEL);1227 kioreq->vcpus, sizeof(*ports));
1228 if (!ports) {1228 if (IS_ERR(ports)) {
1229 ret = -ENOMEM;1229 ret = PTR_ERR(ports);
1230 goto error_kfree;1230 goto error_kfree;
1231 }1231 }
1232 1232
1233 if (copy_from_user(ports, u64_to_user_ptr(ioeventfd->ports), size)) {
1234 ret = -EFAULT;
1235 goto error_kfree_ports;
1236 }
1237
1238 for (i = 0; i < kioreq->vcpus; i++) {1233 for (i = 0; i < kioreq->vcpus; i++) {
1239 kioreq->ports[i].vcpu = i;1234 kioreq->ports[i].vcpu = i;
1240 kioreq->ports[i].port = ports[i];1235 kioreq->ports[i].port = ports[i];
@@ -1256,7 +1251,7 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd) · 15 unmodified lines
1256error_unbind:1251error_unbind:
1257 while (--i >= 0)1252 while (--i >= 0)
1258 unbind_from_irqhandler(irq_from_evtchn(ports[i]), &kioreq->ports[i]);1253 unbind_from_irqhandler(irq_from_evtchn(ports[i]), &kioreq->ports[i]);
1259error_kfree_ports:1254
1260 kfree(ports);1255 kfree(ports);
1261error_kfree:1256error_kfree:
1262 kfree(kioreq);1257 kfree(kioreq);
drivers/xen/xen-balloon.c+1−1
@@ -237,7 +237,7 @@ static const struct attribute_group *balloon_groups[] = { · 236 unmodified lines
237 NULL237 NULL
238};238};
239 239
240static struct bus_type balloon_subsys = {240static const struct bus_type balloon_subsys = {
241 .name = BALLOON_CLASS_NAME,241 .name = BALLOON_CLASS_NAME,
242 .dev_name = BALLOON_CLASS_NAME,242 .dev_name = BALLOON_CLASS_NAME,
243};243};
drivers/xen/xenbus/xenbus_client.c+9−6
@@ -116,14 +116,15 @@ EXPORT_SYMBOL_GPL(xenbus_strstate); · 115 unmodified lines
116 * @dev: xenbus device116 * @dev: xenbus device
117 * @path: path to watch117 * @path: path to watch
118 * @watch: watch to register118 * @watch: watch to register
119 * @will_handle: events queuing determine callback
119 * @callback: callback to register120 * @callback: callback to register
120 *121 *
121 * Register a @watch on the given path, using the given xenbus_watch structure122 * Register a @watch on the given path, using the given xenbus_watch structure
122 * for storage, and the given @callback function as the callback. On success,123 * for storage, @will_handle function as the callback to determine if each
123 * the given @path will be saved as @watch->node, and remains the124 * event need to be queued, and the given @callback function as the callback.
124 * caller's to free. On error, @watch->node will125 * On success, the given @path will be saved as @watch->node, and remains the
125 * be NULL, the device will switch to %XenbusStateClosing, and the error will126 * caller's to free. On error, @watch->node will be NULL, the device will
126 * be saved in the store.127 * switch to %XenbusStateClosing, and the error will be saved in the store.
127 *128 *
128 * Returns: %0 on success or -errno on error129 * Returns: %0 on success or -errno on error
129 */130 */
@@ -158,11 +159,13 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path); · 28 unmodified lines
158 * xenbus_watch_pathfmt - register a watch on a sprintf-formatted path159 * xenbus_watch_pathfmt - register a watch on a sprintf-formatted path
159 * @dev: xenbus device160 * @dev: xenbus device
160 * @watch: watch to register161 * @watch: watch to register
162 * @will_handle: events queuing determine callback
161 * @callback: callback to register163 * @callback: callback to register
162 * @pathfmt: format of path to watch164 * @pathfmt: format of path to watch
163 *165 *
164 * Register a watch on the given @path, using the given xenbus_watch166 * Register a watch on the given @path, using the given xenbus_watch
165 * structure for storage, and the given @callback function as the167 * structure for storage, @will_handle function as the callback to determine if
168 * each event need to be queued, and the given @callback function as the
166 * callback. On success, the watched path (@path/@path2) will be saved169 * callback. On success, the watched path (@path/@path2) will be saved
167 * as @watch->node, and becomes the caller's to kfree().170 * as @watch->node, and becomes the caller's to kfree().
168 * On error, watch->node will be NULL, so the caller has nothing to171 * On error, watch->node will be NULL, so the caller has nothing to
include/uapi/xen/gntalloc.h+4−1
@@ -31,7 +31,10 @@ struct ioctl_gntalloc_alloc_gref { · 30 unmodified lines
31 __u64 index;31 __u64 index;
32 /* The grant references of the newly created grant, one per page */32 /* The grant references of the newly created grant, one per page */
33 /* Variable size, depending on count */33 /* Variable size, depending on count */
34 __u32 gref_ids[1];34 union {
35 __u32 gref_ids[1];
36 __DECLARE_FLEX_ARRAY(__u32, gref_ids_flex);
37 };
35};38};
36 39
37#define GNTALLOC_FLAG_WRITABLE 140#define GNTALLOC_FLAG_WRITABLE 1

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t