Patch-mainline: never (revert original patch due to kabi)
References: bsc#1179508 XSA-349 CVE-2020-29568
From: Juergen Gross <jgross@suse.com>
Date: Tue, 22 Dec 2020 10:22:08 +0100
Subject: [PATCH] xen: revert Count pending messages for each watch
Due to kabi changes revert original patch
"xen/xenbus: Count pending messages for each watch"
(commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc upstream).
The issue will be fixed differently in a followup patch.
Signed-off-by: Juergen Gross <jgross@suse.com>
---
drivers/xen/xenbus/xenbus_xs.c | 29 +++++++++++------------------
include/xen/xenbus.h | 2 --
2 files changed, 11 insertions(+), 20 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index d4de69454c9a..60da7b7db011 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -708,7 +708,6 @@ int xs_watch_msg(struct xs_watch_event *event)
event->path, event->token))) {
spin_lock(&watch_events_lock);
list_add_tail(&event->list, &watch_events);
- event->handle->nr_pending++;
wake_up(&watch_events_waitq);
spin_unlock(&watch_events_lock);
} else
@@ -766,8 +765,6 @@ int register_xenbus_watch(struct xenbus_watch *watch)
sprintf(token, "%lX", (long)watch);
- watch->nr_pending = 0;
-
down_read(&xs_watch_rwsem);
spin_lock(&watches_lock);
@@ -817,14 +814,11 @@ void unregister_xenbus_watch(struct xenbus_watch *watch)
/* Cancel pending watch events. */
spin_lock(&watch_events_lock);
- if (watch->nr_pending) {
- list_for_each_entry_safe(event, tmp, &watch_events, list) {
- if (event->handle != watch)
- continue;
- list_del(&event->list);
- kfree(event);
- }
- watch->nr_pending = 0;
+ list_for_each_entry_safe(event, tmp, &watch_events, list) {
+ if (event->handle != watch)
+ continue;
+ list_del(&event->list);
+ kfree(event);
}
spin_unlock(&watch_events_lock);
@@ -871,6 +865,7 @@ void xs_suspend_cancel(void)
static int xenwatch_thread(void *unused)
{
+ struct list_head *ent;
struct xs_watch_event *event;
xenwatch_pid = current->pid;
@@ -885,15 +880,13 @@ static int xenwatch_thread(void *unused)
mutex_lock(&xenwatch_mutex);
spin_lock(&watch_events_lock);
- event = list_first_entry_or_null(&watch_events,
- struct xs_watch_event, list);
- if (event) {
- list_del(&event->list);
- event->handle->nr_pending--;
- }
+ ent = watch_events.next;
+ if (ent != &watch_events)
+ list_del(ent);
spin_unlock(&watch_events_lock);
- if (event) {
+ if (ent != &watch_events) {
+ event = list_entry(ent, struct xs_watch_event, list);
event->handle->callback(event->handle, event->path,
event->token);
kfree(event);
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index eba01ab5a55e..de5ae6c6fa0f 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -59,8 +59,6 @@ struct xenbus_watch
/* Path being watched. */
const char *node;
- unsigned int nr_pending;
-
/*
* Called just before enqueing new event while a spinlock is held.
* The event will be discarded if this callback returns false.
--
2.26.2