Re: [Xen-devel] [PATCH] gnttab: lock the left grant table earlier in __gnttab_unmap_common()

[Anthony Liguori <anthony@xxxxxxxxxxxxx>]

On Sun, Nov 10, 2013 at 6:07 PM, Matt Wilson <msw@xxxxxxxxx> wrote:
> From: Matt Wilson <msw@xxxxxxxxxx>
>
> Luckily today maptrack_limit never shrinks. But if at some point in
> the future this were to change, checking maptrack_limit without
> holding the grant table spinlock would no longer be safe.

Reviewed-by: Anthony Liguori <aliguori@xxxxxxxxxx>

The commit doesn't mention it, but this problem could cause the
function to fail with "Bad handle" even when the handle is valid (in
theory at least).

If the maptrack table could shrink then it would be a overflow.

Regards,

Anthony Liguori

>
> Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx
> Cc: Keir Fraser <keir@xxxxxxx>
> Cc: Jan Beulich <jbeulich@xxxxxxxx>
> Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Cc: Anthony Liguori <aliguori@xxxxxxxxxx>
> Signed-off-by: Matt Wilson <msw@xxxxxxxxxx>
> ---
>  xen/common/grant_table.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
> index 21c6a14..ef10ff4 100644
> --- a/xen/common/grant_table.c
> +++ b/xen/common/grant_table.c
> @@ -842,15 +842,16 @@ __gnttab_unmap_common(
>
>      op->frame = (unsigned long)(op->dev_bus_addr >> PAGE_SHIFT);
>
> +    spin_lock(&lgt->lock);
>      if ( unlikely(op->handle >= lgt->maptrack_limit) )
>      {
> +        spin_unlock(&lgt->lock);
>          gdprintk(XENLOG_INFO, "Bad handle (%d).\n", op->handle);
>          op->status = GNTST_bad_handle;
>          return;
>      }
>
>      op->map = &maptrack_entry(lgt, op->handle);
> -    spin_lock(&lgt->lock);
>
>      if ( unlikely(!op->map->flags) )
>      {
> --
> 1.7.9.5
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel