Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP3:Update
xen
xsa313-2.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xsa313-2.patch of Package xen
xenoprof: limit consumption of shared buffer data Since the shared buffers can be written to by guests, we may only read the head and tail pointers from them (all other fields should only ever be written to). Furthermore, for any particular operation the two values must be read exactly once, with both checks and consumption happening with the thus read values. (The backtrace related xenoprof_buf_space() use in xenoprof_log_event() is an exception: The values used there get re-checked by every subsequent xenoprof_add_sample().) Since that code needed touching, also fix the double increment of the lost samples count in case the backtrace related xenoprof_add_sample() invocation in xenoprof_log_event() fails. Where code is being touched anyway, add const as appropriate. This is part of XSA-313. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> --- I've resisted to make variables unsigned, but I couldn't resist adding const in code I had to touch anyway. --- a/xen/common/xenoprof.c +++ b/xen/common/xenoprof.c @@ -474,25 +474,24 @@ static int add_passive_list(XEN_GUEST_HA /* Get space in the buffer */ -static int xenoprof_buf_space(struct domain *d, xenoprof_buf_t * buf, int size) +static int xenoprof_buf_space(const struct domain *d, + int head, int tail, int size) { - int head, tail; - - head = xenoprof_buf(d, buf, event_head); - tail = xenoprof_buf(d, buf, event_tail); - return ((tail > head) ? 0 : size) + tail - head - 1; } /* Check for space and add a sample. Return 1 if successful, 0 otherwise. */ -static int xenoprof_add_sample(struct domain *d, xenoprof_buf_t *buf, +static int xenoprof_add_sample(const struct domain *d, + const struct xenoprof_vcpu *v, uint64_t eip, int mode, int event) { + xenoprof_buf_t *buf = v->buffer; int head, tail, size; head = xenoprof_buf(d, buf, event_head); tail = xenoprof_buf(d, buf, event_tail); - size = xenoprof_buf(d, buf, event_size); + barrier(); + size = v->event_size; /* make sure indexes in shared buffer are sane */ if ( (head < 0) || (head >= size) || (tail < 0) || (tail >= size) ) @@ -501,7 +500,7 @@ static int xenoprof_add_sample(struct do return 0; } - if ( xenoprof_buf_space(d, buf, size) > 0 ) + if ( xenoprof_buf_space(d, head, tail, size) > 0 ) { xenoprof_buf(d, buf, event_log[head].eip) = eip; xenoprof_buf(d, buf, event_log[head].mode) = mode; @@ -525,7 +524,6 @@ static int xenoprof_add_sample(struct do int xenoprof_add_trace(struct vcpu *vcpu, uint64_t pc, int mode) { struct domain *d = vcpu->domain; - xenoprof_buf_t *buf = d->xenoprof->vcpu[vcpu->vcpu_id].buffer; /* Do not accidentally write an escape code due to a broken frame. */ if ( pc == XENOPROF_ESCAPE_CODE ) @@ -534,7 +532,8 @@ int xenoprof_add_trace(struct vcpu *vcpu return 0; } - return xenoprof_add_sample(d, buf, pc, mode, 0); + return xenoprof_add_sample(d, &d->xenoprof->vcpu[vcpu->vcpu_id], + pc, mode, 0); } void xenoprof_log_event(struct vcpu *vcpu, const struct cpu_user_regs *regs, @@ -565,17 +564,21 @@ void xenoprof_log_event(struct vcpu *vcp /* Provide backtrace if requested. */ if ( backtrace_depth > 0 ) { - if ( (xenoprof_buf_space(d, buf, v->event_size) < 2) || - !xenoprof_add_sample(d, buf, XENOPROF_ESCAPE_CODE, mode, - XENOPROF_TRACE_BEGIN) ) + if ( xenoprof_buf_space(d, xenoprof_buf(d, buf, event_head), + xenoprof_buf(d, buf, event_tail), + v->event_size) < 2 ) { xenoprof_buf(d, buf, lost_samples)++; lost_samples++; return; } + + if ( !xenoprof_add_sample(d, v, XENOPROF_ESCAPE_CODE, mode, + XENOPROF_TRACE_BEGIN) ) + return; } - if ( xenoprof_add_sample(d, buf, pc, mode, event) ) + if ( xenoprof_add_sample(d, v, pc, mode, event) ) { if ( is_active(vcpu->domain) ) active_samples++;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor