[Xen-changelog] [linux-2.6.18-xen] usbback: don't access request fields in shared ring more than once

[Xen patchbot-linux-2.6.18-xen <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <jbeulich@xxxxxxxx>
# Date 1412586418 -7200
# Node ID 809680069660b199d48fc9e235cfdefdcf391ca7
# Parent  ab22257ffed27a8700322f1a185a399dca909c59
usbback: don't access request fields in shared ring more than once

... as being unsafe (prone to the fields changing under our feet). Now
that we copy the request, undo 1264:ab22257ffed2 ("usbback: mark
request as consumed after finished using it") at once.

For the usbbk_hotplug_notify() case adjust the code slightly too
despite there not being explicit issues - just make obvious that there
are no multiple field accesses here by not even using an intermediate
variable.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---


diff -r ab22257ffed2 -r 809680069660 drivers/xen/usbback/usbback.c
--- a/drivers/xen/usbback/usbback.c     Fri Sep 26 12:04:11 2014 +0200
+++ b/drivers/xen/usbback/usbback.c     Mon Oct 06 11:06:58 2014 +0200
@@ -970,7 +970,6 @@ fail_response:
 static int usbbk_start_submit_urb(usbif_t *usbif)
 {
        usbif_urb_back_ring_t *urb_ring = &usbif->urb_ring;
-       usbif_urb_request_t *req;
        pending_req_t *pending_req;
        RING_IDX rc, rp;
        int more_to_do = 0;
@@ -989,6 +988,8 @@ static int usbbk_start_submit_urb(usbif_
        }
 
        while (rc != rp) {
+               usbif_urb_request_t req;
+
                if (RING_REQUEST_CONS_OVERFLOW(urb_ring, rc)) {
                        if(printk_ratelimit())
                                printk(KERN_WARNING "usbback: "
@@ -1002,11 +1003,11 @@ static int usbbk_start_submit_urb(usbif_
                        break;
                }
 
-               req = RING_GET_REQUEST(urb_ring, rc);
+               req = *RING_GET_REQUEST(urb_ring, rc);
+               urb_ring->req_cons = ++rc;
+               barrier();
 
-               dispatch_request_to_pending_reqs(usbif, req,
-                                                       pending_req);
-               urb_ring->req_cons = ++rc;
+               dispatch_request_to_pending_reqs(usbif, &req, pending_req);
 
                cond_resched();
        }
@@ -1019,7 +1020,6 @@ static int usbbk_start_submit_urb(usbif_
 void usbbk_hotplug_notify(usbif_t *usbif, int portnum, int speed)
 {
        usbif_conn_back_ring_t *ring = &usbif->conn_ring;
-       usbif_conn_request_t *req;
        usbif_conn_response_t *res;
        unsigned long flags;
        u16 id;
@@ -1027,8 +1027,7 @@ void usbbk_hotplug_notify(usbif_t *usbif
 
        spin_lock_irqsave(&usbif->conn_ring_lock, flags);
 
-       req = RING_GET_REQUEST(ring, ring->req_cons);;
-       id = req->id;
+       id = RING_GET_REQUEST(ring, ring->req_cons)->id;
        ring->req_cons++;
        ring->sring->req_event = ring->req_cons + 1;
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog