From: "Jan Beulich" <JBeulich@novell.com>
To: George Dunlap <dunlapg@umich.edu>
Cc: xen-devel@lists.xensource.com
Subject: [PATCH 0/6] trace: miscellaneous fixes
Date: Tue, 29 Jun 2010 16:29:14 +0100 [thread overview]
Message-ID: <4C2A2D6A0200007800008A52@vpn.id2.novell.com> (raw)
In-Reply-To: <AANLkTimiK-6Dx6q4WNuSwoEGLMJKpzre8lWn225X_pzV@mail.gmail.com>
After getting a report of 3.2.3's xenmon crashing Xen (as it turned out
this was because c/s 17000 was backported to that tree without also
applying c/s 17515), this is the result of reviewing the code for
security issues:
- the hypervisor should not rely on any specific state of the actual
trace buffer (as it is shared writable with Dom0)
- there's no need to share writably the t_info pages (Dom0 only wants
[and needs] to read it)
- T_INFO_FIRST_OFFSET wasn't defined correctly, thus allowing in the
num_online_cpus() == NR_CPUS case to pass a corrupted MFN to Dom0
- check_tbuf_size() didn't consider the case of the incoming size not
allowing for the 2*data_size range for t_buf->{prod,cons}
- printk()-s should be lower level or rate limited
For the first of those items, I chose to use 'volatile' qualifiers
rather than sprinkling around barriers - this can certainly be changed
if considered unacceptable.
To make clear what purpose specific variables have and/or where they
got loaded from, the patch also changes the type of some of them to
be explicitly u32/s32, and removes pointless assertions (like checking
an unsigned variable to be >= 0).
I also took the prototype adjustment of __trace_var() as an opportunity
to simplify the TRACE_xD() macros. Similar simplification could be done
on the (quite numerous) direct callers of the function.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
next prev parent reply other threads:[~2010-06-29 15:29 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-06-28 10:39 [PATCH] trace security fixes Jan Beulich
2010-06-28 11:12 ` Keir Fraser
2010-06-28 12:02 ` Jan Beulich
2010-06-29 14:21 ` George Dunlap
2010-06-29 15:29 ` Jan Beulich [this message]
-- strict thread matches above, loose matches on Subject: below --
2010-06-29 15:37 [PATCH 0/6] trace: miscellaneous fixes Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C2A2D6A0200007800008A52@vpn.id2.novell.com \
--to=jbeulich@novell.com \
--cc=dunlapg@umich.edu \
--cc=xen-devel@lists.xensource.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).