summaryrefslogtreecommitdiff
path: root/system/xen
diff options
context:
space:
mode:
authorMario Preksavec <mario@slackware.hr>2017-10-26 23:49:10 +0200
committerWilly Sudiarto Raharjo <willysr@slackbuilds.org>2017-10-28 07:07:20 +0700
commit6eb216548564434e512cb74e8e55341e14fedbf1 (patch)
treeb4732523865ef205c888bfb042734105f03394c4 /system/xen
parent3a1250c13700ca4fadf1bf004ae2f08a2909e97c (diff)
downloadslackbuilds-6eb216548564434e512cb74e8e55341e14fedbf1.tar.gz
system/xen: XSA 236 update.
Signed-off-by: Mario Preksavec <mario@slackware.hr>
Diffstat (limited to 'system/xen')
-rw-r--r--system/xen/xen.SlackBuild2
-rw-r--r--system/xen/xsa/xsa236-4.9.patch66
2 files changed, 67 insertions, 1 deletions
diff --git a/system/xen/xen.SlackBuild b/system/xen/xen.SlackBuild
index 4405bf7284..66a75aadba 100644
--- a/system/xen/xen.SlackBuild
+++ b/system/xen/xen.SlackBuild
@@ -24,7 +24,7 @@
PRGNAM=xen
VERSION=${VERSION:-4.9.0}
-BUILD=${BUILD:-4}
+BUILD=${BUILD:-5}
TAG=${TAG:-_SBo}
SEABIOS=${SEABIOS:-1.10.0}
diff --git a/system/xen/xsa/xsa236-4.9.patch b/system/xen/xsa/xsa236-4.9.patch
new file mode 100644
index 0000000000..203025dbae
--- /dev/null
+++ b/system/xen/xsa/xsa236-4.9.patch
@@ -0,0 +1,66 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: gnttab: fix pin count / page reference race
+
+Dropping page references before decrementing pin counts is a bad idea
+if assumptions are being made that a non-zero pin count implies a valid
+page. Fix the order of operations in gnttab_copy_release_buf(), but at
+the same time also remove the assertion that was found to trigger:
+map_grant_ref() also has the potential of causing a race here, and
+changing the order of operations there would likely be quite a bit more
+involved.
+
+This is XSA-236.
+
+Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+--- a/xen/common/grant_table.c
++++ b/xen/common/grant_table.c
+@@ -2330,9 +2330,20 @@ __acquire_grant_for_copy(
+ td = page_get_owner_and_reference(*page);
+ /*
+ * act->pin being non-zero should guarantee the page to have a
+- * non-zero refcount and hence a valid owner.
++ * non-zero refcount and hence a valid owner (matching the one on
++ * record), with one exception: If the owning domain is dying we
++ * had better not make implications from pin count (map_grant_ref()
++ * updates pin counts before obtaining page references, for
++ * example).
+ */
+- ASSERT(td);
++ if ( td != rd || rd->is_dying )
++ {
++ if ( td )
++ put_page(*page);
++ *page = NULL;
++ rc = GNTST_bad_domain;
++ goto unlock_out_clear;
++ }
+ }
+
+ act->pin += readonly ? GNTPIN_hstr_inc : GNTPIN_hstw_inc;
+@@ -2451,6 +2462,11 @@ static void gnttab_copy_release_buf(stru
+ unmap_domain_page(buf->virt);
+ buf->virt = NULL;
+ }
++ if ( buf->have_grant )
++ {
++ __release_grant_for_copy(buf->domain, buf->ptr.u.ref, buf->read_only);
++ buf->have_grant = 0;
++ }
+ if ( buf->have_type )
+ {
+ put_page_type(buf->page);
+@@ -2461,11 +2477,6 @@ static void gnttab_copy_release_buf(stru
+ put_page(buf->page);
+ buf->page = NULL;
+ }
+- if ( buf->have_grant )
+- {
+- __release_grant_for_copy(buf->domain, buf->ptr.u.ref, buf->read_only);
+- buf->have_grant = 0;
+- }
+ }
+
+ static int gnttab_copy_claim_buf(const struct gnttab_copy *op,