xen-devel.lists.xenproject.org archive mirror
 help / color / mirror / Atom feed
From: "Jan Beulich" <JBeulich@novell.com>
To: George Dunlap <dunlapg@umich.edu>
Cc: xen-devel@lists.xensource.com
Subject: [PATCH 0/6] trace: miscellaneous fixes
Date: Tue, 29 Jun 2010 16:29:14 +0100	[thread overview]
Message-ID: <4C2A2D6A0200007800008A52@vpn.id2.novell.com> (raw)
In-Reply-To: <AANLkTimiK-6Dx6q4WNuSwoEGLMJKpzre8lWn225X_pzV@mail.gmail.com>

After getting a report of 3.2.3's xenmon crashing Xen (as it turned out
this was because c/s 17000 was backported to that tree without also
applying c/s 17515), this is the result of reviewing the code for
security issues:
- the hypervisor should not rely on any specific state of the actual
  trace buffer (as it is shared writable with Dom0)
- there's no need to share writably the t_info pages (Dom0 only wants
  [and needs] to read it)
- T_INFO_FIRST_OFFSET wasn't defined correctly, thus allowing in the
  num_online_cpus() == NR_CPUS case to pass a corrupted MFN to Dom0
- check_tbuf_size() didn't consider the case of the incoming size not
  allowing for the 2*data_size range for t_buf->{prod,cons}
- printk()-s should be lower level or rate limited

For the first of those items, I chose to use 'volatile' qualifiers
rather than sprinkling around barriers - this can certainly be changed
if considered unacceptable.

To make clear what purpose specific variables have and/or where they
got loaded from, the patch also changes the type of some of them to
be explicitly u32/s32, and removes pointless assertions (like checking
an unsigned variable to be >= 0).

I also took the prototype adjustment of __trace_var() as an opportunity
to simplify the TRACE_xD() macros. Similar simplification could be done
on the (quite numerous) direct callers of the function.

Signed-off-by: Jan Beulich <jbeulich@novell.com>

  reply	other threads:[~2010-06-29 15:29 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-06-28 10:39 [PATCH] trace security fixes Jan Beulich
2010-06-28 11:12 ` Keir Fraser
2010-06-28 12:02   ` Jan Beulich
2010-06-29 14:21 ` George Dunlap
2010-06-29 15:29   ` Jan Beulich [this message]
  -- strict thread matches above, loose matches on Subject: below --
2010-06-29 15:37 [PATCH 0/6] trace: miscellaneous fixes Jan Beulich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4C2A2D6A0200007800008A52@vpn.id2.novell.com \
    --to=jbeulich@novell.com \
    --cc=dunlapg@umich.edu \
    --cc=xen-devel@lists.xensource.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).