linux-toradex.git/drivers/xen, branch tegra

xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX.

2012-01-18T15:31:57+00:00

commit 9e7860cee18241633eddb36a4c34c7b61d8cecbc upstream.

Haogang Chen found out that:

 There is a potential integer overflow in process_msg() that could result
 in cross-domain attack.

 	body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);

 When a malicious guest passes 0xffffffff in msg->hdr.len, the subsequent
 call to xb_read() would write to a zero-length buffer.

 The other end of this connection is always the xenstore backend daemon
 so there is no guest (malicious or otherwise) which can do this. The
 xenstore daemon is a trusted component in the system.

 However this seem like a reasonable robustness improvement so we should
 have it.

And Ian when read the API docs found that:
        The payload length (len field of the header) is limited to 4096
        (XENSTORE_PAYLOAD_MAX) in both directions.  If a client exceeds the
        limit, its xenstored connection will be immediately killed by
        xenstored, which is usually catastrophic from the client's point of
        view.  Clients (particularly domains, which cannot just reconnect)
        should avoid this.

so this patch checks against that instead.

This also avoids a potential integer overflow pointed out by Haogang Chen.

Signed-off-by: Ian Campbell 
Cc: Haogang Chen 
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman

xen-gntalloc: signedness bug in add_grefs()

2011-11-21T22:35:26+00:00

commit 99cb2ddcc617f43917e94a4147aa3ccdb2bcd77e upstream.

gref->gref_id is unsigned so the error handling didn't work.
gnttab_grant_foreign_access() returns an int type, so we can add a
cast here, and it doesn't cause any problems.
gnttab_grant_foreign_access() can return a variety of errors
including -ENOSPC, -ENOSYS and -ENOMEM.

Signed-off-by: Dan Carpenter 
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman

xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()

2011-11-21T22:35:26+00:00

commit 21643e69a4c06f7ef155fbc70e3fba13fba4a756 upstream.

On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected.  If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().

Signed-off-by: Dan Carpenter 
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman

genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier

2011-11-11T17:43:13+00:00

commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream.

This adds a mechanism to resume selected IRQs during syscore_resume
instead of dpm_resume_noirq.

Under Xen we need to resume IRQs associated with IPIs early enough
that the resched IPI is unmasked and we can therefore schedule
ourselves out of the stop_machine where the suspend/resume takes
place.

This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME".

Signed-off-by: Ian Campbell 
Cc: Rafael J. Wysocki 
Cc: Jeremy Fitzhardinge 
Cc: xen-devel 
Cc: Konrad Rzeszutek Wilk 
Link: http://lkml.kernel.org/r/1318713254.11016.52.camel@dagon.hellion.org.uk
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

xen-swiotlb: Fix wrong panic.

2011-11-11T17:42:48+00:00

commit ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 upstream.

Propagate the baremetal git commit "swiotlb: fix wrong panic"
(fba99fa38b023224680308a482e12a0eca87e4e1) in the Xen-SWIOTLB version.
wherein swiotlb's map_page wrongly calls panic() when it can't find
a buffer fit for device's dma mask.  It should return an error instead.

Devices with an odd dma mask (i.e.  under 4G) like b44 network card hit
this bug (the system crashes):

http://marc.info/?l=linux-kernel&m=129648943830106&w=2

If xen-swiotlb returns an error, b44 driver can use the own bouncing
mechanism.

Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman

xen/irq: Alter the locking to use a mutex instead of a spinlock.

2011-09-15T08:32:02+00:00

When we allocate/change the IRQ informations, we do not
need to use spinlocks. We can use a mutex (which is
what the generic IRQ code does for allocations/changes).
Fixes a slew of:

BUG: sleeping function called from invalid context at /linux/kernel/mutex.c:271
in_atomic(): 1, irqs_disabled(): 0, pid: 3216, name: xenstored
2 locks held by xenstored/3216:
 #0:  (&u->bind_mutex){......}, at: [] evtchn_ioctl+0x30/0x3a0 [xen_evtchn]
 #1:  (irq_mapping_update_lock){......}, at: [] bind_evtchn_to_irq+0x24/0x90
Pid: 3216, comm: xenstored Not tainted 3.1.0-rc6-00021-g437a3d1 #2
Call Trace:
 [] __might_sleep+0x100/0x130
 [] mutex_lock_nested+0x2f/0x50
 [] __irq_alloc_descs+0x49/0x200
 [] ? evtchn_ioctl+0x30/0x3a0 [xen_evtchn]
 [] xen_allocate_irq_dynamic+0x34/0x70
 [] bind_evtchn_to_irq+0x5d/0x90
 [] ? evtchn_bind_to_user+0x60/0x60 [xen_evtchn]
 [] bind_evtchn_to_irqhandler+0x32/0x80
 [] evtchn_bind_to_user+0x49/0x60 [xen_evtchn]
 [] evtchn_ioctl+0x144/0x3a0 [xen_evtchn]
 [] ? vfsmount_lock_local_unlock+0x50/0x80
 [] do_vfs_ioctl+0x9a/0x5e0
 [] ? mntput+0x1f/0x30
 [] ? fput+0x199/0x240
 [] sys_ioctl+0xa1/0xb0
 [] system_call_fastpath+0x16/0x1b

Reported-by: Jim Burns 
Acked-by: Ian Campbell 
Signed-off-by: Konrad Rzeszutek Wilk

xen: xen-selfballoon.c needs more header files

2011-08-10T19:21:46+00:00

Fix build errors (found when CONFIG_SYSFS is not enabled):

drivers/xen/xen-selfballoon.c:446: warning: data definition has no type or storage class
drivers/xen/xen-selfballoon.c:446: warning: type defaults to 'int' in declaration of 'EXPORT_SYMBOL'
drivers/xen/xen-selfballoon.c:446: warning: parameter names (without types) in function declaration
drivers/xen/xen-selfballoon.c:485: error: expected declaration specifiers or '...' before string constant
drivers/xen/xen-selfballoon.c:485: warning: data definition has no type or storage class
drivers/xen/xen-selfballoon.c:485: warning: type defaults to 'int' in declaration of 'MODULE_LICENSE'
drivers/xen/xen-selfballoon.c:485: warning: function declaration isn't a prototype

Signed-off-by: Randy Dunlap 
Signed-off-by: Konrad Rzeszutek Wilk

xen/self-balloon: Add dependency on tmem.

2011-08-03T18:34:57+00:00

Without enabling CONFIG_XEN_TMEM we get this:

drivers/xen/xen-selfballoon.c:461: undefined reference to `tmem_enabled'

Signed-off-by: Konrad Rzeszutek Wilk

xen/balloon: Fix compile errors - missing header files.

2011-08-03T18:34:55+00:00

With a specific enough .config file compile errors show
for missing workqueue declarations.

Reported-by: Randy Dunlap 
Signed-off-by: Konrad Rzeszutek Wilk

xen/grant: Fix compile warning.

2011-08-03T18:34:53+00:00

drivers/xen/grant-table.c:85: warning: ‘rc’ may be used uninitialized in this function

Signed-off-by: Konrad Rzeszutek Wilk