From mboxrd@z Thu Jan  1 00:00:00 1970
From: George Dunlap <george.dunlap@eu.citrix.com>
Subject: Re: [PATCH 1/2] Fix sched_priv corruption in ARINC653
 alloc_vdata.
Date: Mon, 4 Nov 2013 15:49:43 +0000
Message-ID: <5277C217.3080704@eu.citrix.com>
References: <1383252473-3067-1-git-send-email-nate.studer@dornerworks.com>
	<1383252473-3067-2-git-send-email-nate.studer@dornerworks.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <1383252473-3067-2-git-send-email-nate.studer@dornerworks.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Nathan Studer <nate.studer@dornerworks.com>, xen-devel@lists.xen.org
Cc: smartin@milliways.cl, robert.vanvossen@dornerworks.com
List-Id: xen-devel@lists.xenproject.org

On 31/10/13 20:47, Nathan Studer wrote:
> From: Nathan Studer <nate.studer@dornerworks.com>
>
> The ARINC653 scheduler was directly assigning and manipulating
> the sched_priv field of a vcpu in its alloc_vdata function.
>
> When creating a cpu pool, this resulted in the corruption
> of the sched_priv field of the vcpu, which was then passed
> to the initial scheduler's free_vdata function with
> disastrous results.
>
> Signed-off-by: Nathan Studer <nate.studer@dornerworks.com>

Reviewed-by: George Dunlap <george.dunlap@eu.citrix.com>

> ---
>   xen/common/sched_arinc653.c |   15 +++++++++------
>   1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/xen/common/sched_arinc653.c b/xen/common/sched_arinc653.c
> index 2502192..a1d9443 100644
> --- a/xen/common/sched_arinc653.c
> +++ b/xen/common/sched_arinc653.c
> @@ -380,11 +380,14 @@ a653sched_deinit(const struct scheduler *ops)
>   static void *
>   a653sched_alloc_vdata(const struct scheduler *ops, struct vcpu *vc, void *dd)
>   {
> +    arinc653_vcpu_t *svc;
> +
>       /*
>        * Allocate memory for the ARINC 653-specific scheduler data information
>        * associated with the given VCPU (vc).
> -     */
> -    if ( (vc->sched_priv = xmalloc(arinc653_vcpu_t)) == NULL )
> +     */
> +    svc = xmalloc(arinc653_vcpu_t);
> +    if ( svc == NULL )
>           return NULL;
>   
>       /*
> @@ -393,13 +396,13 @@ a653sched_alloc_vdata(const struct scheduler *ops, struct vcpu *vc, void *dd)
>        * will call the vcpu_wake scheduler callback function and our scheduler
>        * will mark the VCPU awake.
>        */
> -    AVCPU(vc)->vc = vc;
> -    AVCPU(vc)->awake = 0;
> +    svc->vc = vc;
> +    svc->awake = 0;
>       if ( !is_idle_vcpu(vc) )
> -        list_add(&AVCPU(vc)->list, &SCHED_PRIV(ops)->vcpu_list);
> +        list_add(&svc->list, &SCHED_PRIV(ops)->vcpu_list);
>       update_schedule_vcpus(ops);
>   
> -    return AVCPU(vc);
> +    return svc;
>   }
>   
>   /**