* Re: [PATCH] xen/blkback: fix reference counting
[not found] <1378378814-23721-1-git-send-email-vegard.nossum@oracle.com>
@ 2013-09-06 13:37 ` Konrad Rzeszutek Wilk
2013-09-06 13:37 ` Konrad Rzeszutek Wilk
1 sibling, 0 replies; 2+ messages in thread
From: Konrad Rzeszutek Wilk @ 2013-09-06 13:37 UTC (permalink / raw)
To: Vegard Nossum; +Cc: xen-devel, Jan Beulich, Ian Campbell, stable, linux-kernel
On Thu, Sep 05, 2013 at 01:00:14PM +0200, Vegard Nossum wrote:
> If the permission check fails, we drop a reference to the blkif without
> having taken it in the first place. The bug was introduced in commit
> 604c499cbbcc3d5fe5fb8d53306aa0fae1990109 (xen/blkback: Check device
> permissions before allowing OP_DISCARD).
>
> Cc: stable@vger.kernel.org
> Cc: Jan Beulich <JBeulich@suse.com>
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Thank you for spotting that. Let me stick it on my for-jens queue.
> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
> ---
> drivers/block/xen-blkback/blkback.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
> index bf4b9d2..6620b73 100644
> --- a/drivers/block/xen-blkback/blkback.c
> +++ b/drivers/block/xen-blkback/blkback.c
> @@ -872,49 +872,50 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
> }
>
> unmap:
> if (segments)
> kunmap_atomic(segments);
> xen_blkbk_unmap(blkif, pages, indirect_grefs);
> return rc;
> }
>
> static int dispatch_discard_io(struct xen_blkif *blkif,
> struct blkif_request *req)
> {
> int err = 0;
> int status = BLKIF_RSP_OKAY;
> struct block_device *bdev = blkif->vbd.bdev;
> unsigned long secure;
> struct phys_req preq;
>
> + xen_blkif_get(blkif);
> +
> preq.sector_number = req->u.discard.sector_number;
> preq.nr_sects = req->u.discard.nr_sectors;
>
> err = xen_vbd_translate(&preq, blkif, WRITE);
> if (err) {
> pr_warn(DRV_PFX "access denied: DISCARD [%llu->%llu] on dev=%04x\n",
> preq.sector_number,
> preq.sector_number + preq.nr_sects, blkif->vbd.pdevice);
> goto fail_response;
> }
> blkif->st_ds_req++;
>
> - xen_blkif_get(blkif);
> secure = (blkif->vbd.discard_secure &&
> (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
> BLKDEV_DISCARD_SECURE : 0;
>
> err = blkdev_issue_discard(bdev, req->u.discard.sector_number,
> req->u.discard.nr_sectors,
> GFP_KERNEL, secure);
> fail_response:
> if (err == -EOPNOTSUPP) {
> pr_debug(DRV_PFX "discard op failed, not supported\n");
> status = BLKIF_RSP_EOPNOTSUPP;
> } else if (err)
> status = BLKIF_RSP_ERROR;
>
> make_response(blkif, req->u.discard.id, req->operation, status);
> xen_blkif_put(blkif);
> return err;
> }
> --
> 1.7.10.4
>
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] xen/blkback: fix reference counting
[not found] <1378378814-23721-1-git-send-email-vegard.nossum@oracle.com>
2013-09-06 13:37 ` [PATCH] xen/blkback: fix reference counting Konrad Rzeszutek Wilk
@ 2013-09-06 13:37 ` Konrad Rzeszutek Wilk
1 sibling, 0 replies; 2+ messages in thread
From: Konrad Rzeszutek Wilk @ 2013-09-06 13:37 UTC (permalink / raw)
To: Vegard Nossum; +Cc: Ian Campbell, linux-kernel, xen-devel, stable, Jan Beulich
On Thu, Sep 05, 2013 at 01:00:14PM +0200, Vegard Nossum wrote:
> If the permission check fails, we drop a reference to the blkif without
> having taken it in the first place. The bug was introduced in commit
> 604c499cbbcc3d5fe5fb8d53306aa0fae1990109 (xen/blkback: Check device
> permissions before allowing OP_DISCARD).
>
> Cc: stable@vger.kernel.org
> Cc: Jan Beulich <JBeulich@suse.com>
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Thank you for spotting that. Let me stick it on my for-jens queue.
> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
> ---
> drivers/block/xen-blkback/blkback.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
> index bf4b9d2..6620b73 100644
> --- a/drivers/block/xen-blkback/blkback.c
> +++ b/drivers/block/xen-blkback/blkback.c
> @@ -872,49 +872,50 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
> }
>
> unmap:
> if (segments)
> kunmap_atomic(segments);
> xen_blkbk_unmap(blkif, pages, indirect_grefs);
> return rc;
> }
>
> static int dispatch_discard_io(struct xen_blkif *blkif,
> struct blkif_request *req)
> {
> int err = 0;
> int status = BLKIF_RSP_OKAY;
> struct block_device *bdev = blkif->vbd.bdev;
> unsigned long secure;
> struct phys_req preq;
>
> + xen_blkif_get(blkif);
> +
> preq.sector_number = req->u.discard.sector_number;
> preq.nr_sects = req->u.discard.nr_sectors;
>
> err = xen_vbd_translate(&preq, blkif, WRITE);
> if (err) {
> pr_warn(DRV_PFX "access denied: DISCARD [%llu->%llu] on dev=%04x\n",
> preq.sector_number,
> preq.sector_number + preq.nr_sects, blkif->vbd.pdevice);
> goto fail_response;
> }
> blkif->st_ds_req++;
>
> - xen_blkif_get(blkif);
> secure = (blkif->vbd.discard_secure &&
> (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
> BLKDEV_DISCARD_SECURE : 0;
>
> err = blkdev_issue_discard(bdev, req->u.discard.sector_number,
> req->u.discard.nr_sectors,
> GFP_KERNEL, secure);
> fail_response:
> if (err == -EOPNOTSUPP) {
> pr_debug(DRV_PFX "discard op failed, not supported\n");
> status = BLKIF_RSP_EOPNOTSUPP;
> } else if (err)
> status = BLKIF_RSP_ERROR;
>
> make_response(blkif, req->u.discard.id, req->operation, status);
> xen_blkif_put(blkif);
> return err;
> }
> --
> 1.7.10.4
>
^ permalink raw reply [flat|nested] 2+ messages in thread