Received: by 10.223.185.116 with SMTP id b49csp1016966wrg; Wed, 21 Feb 2018 10:37:40 -0800 (PST) X-Google-Smtp-Source: AH8x227ZM673G8iFW6n+Z/KTbIK08Z6dw28/pXxcOjy22prW/TElS5mQMLrcwTEiE+fJpXjnR82G X-Received: by 2002:a17:902:4a0c:: with SMTP id w12-v6mr446745pld.192.1519238259898; Wed, 21 Feb 2018 10:37:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519238259; cv=none; d=google.com; s=arc-20160816; b=PrTTYm5S7WSGgXJV4rT+/Gr5djgE1fYecowbSTuWmF2RqrmljG05s5RYXrrk2+xaxP tG4VLG04Bp8PAOgeahNv9WhbpHbGKZkg+N0aFHKGUNIKOLq5Y6jrNj0NuqEEuPze4Phi dEabVi6VdyvE5x/2NOJ8uGSL3opGrYvh8Qt/ziK2AwXpxVXdGHjEIA5A+N+nUeG29vCt 2STD+jiPvj4hByqgbeEUYZfmsAZfhLp5HvlWzP8JI89hf1F0dQkqZc+lf2KN3dGOyfen 6phLrbt0Wn4YYGadoG/j2LD36bNQ9Zj3ntZiPQ+6swzd4Ah24Vnjn+F5gSA1yeydGSQ4 jMhw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=qamg/zfZjwgwUjZyV5GJR3CRq4QX2xIBROYqFA4F7N0=; b=qKYgeg6iJe/sYeI4bVhzyDbqxvKCRxFIc17USu9h2TVIxq+duKkECGTjCTFQ4RjYFC 79h1mJijDaL7RNR+8/Q+eYKE9yvr0wezkfsBaVZ685wJUtSRzQv2mIP+j8Kh+I05F9tY xMG1q3ZIzlHPMYDy+s7hi+HqdJSe4PpZILWjCkorbbGvrtabMMJuSqikSAnCRBsKGn7M tS/7WK/Zbw1VM1oNQ/0J5Vzcf/9OCZR7HuLtcLug6ncMxqSCMN0bFb4iIrN67E1IppqM NXNGPCNiOjEi0hXOvVfXIv6KJdy4oOJZoZ+/wwNE3H7R/rzyiyCcdZp+cduWh77R+MR8 KFGg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 1-v6si14552392plr.786.2018.02.21.10.37.26; Wed, 21 Feb 2018 10:37:39 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S936403AbeBUNL0 (ORCPT + 99 others); Wed, 21 Feb 2018 08:11:26 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:44654 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S936274AbeBUNLQ (ORCPT ); Wed, 21 Feb 2018 08:11:16 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 7E663123A; Wed, 21 Feb 2018 13:11:15 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bhavesh Davda , Joao Martins , Juergen Gross Subject: [PATCH 4.15 123/163] xenbus: track caller request id Date: Wed, 21 Feb 2018 13:49:12 +0100 Message-Id: <20180221124536.906856947@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180221124529.931834518@linuxfoundation.org> References: <20180221124529.931834518@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joao Martins commit 29fee6eed2811ff1089b30fc579a2d19d78016ab upstream. Commit fd8aa9095a95 ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") optimized xenbus concurrent accesses but in doing so broke UABI of /dev/xen/xenbus. Through /dev/xen/xenbus applications are in charge of xenbus message exchange with the correct header and body. Now, after the mentioned commit the replies received by application will no longer have the header req_id echoed back as it was on request (see specification below for reference), because that particular field is being overwritten by kernel. struct xsd_sockmsg { uint32_t type; /* XS_??? */ uint32_t req_id;/* Request identifier, echoed in daemon's response. */ uint32_t tx_id; /* Transaction id (0 if not related to a transaction). */ uint32_t len; /* Length of data following this. */ /* Generally followed by nul-terminated string(s). */ }; Before there was only one request at a time so req_id could simply be forwarded back and forth. To allow simultaneous requests we need a different req_id for each message thus kernel keeps a monotonic increasing counter for this field and is written on every request irrespective of userspace value. Forwarding again the req_id on userspace requests is not a solution because we would open the possibility of userspace-generated req_id colliding with kernel ones. So this patch instead takes another route which is to artificially keep user req_id while keeping the xenbus logic as is. We do that by saving the original req_id before xs_send(), use the private kernel counter as req_id and then once reply comes and was validated, we restore back the original req_id. Cc: # 4.11 Fixes: fd8aa9095a ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") Reported-by: Bhavesh Davda Signed-off-by: Joao Martins Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman --- drivers/xen/xenbus/xenbus.h | 1 + drivers/xen/xenbus/xenbus_comms.c | 1 + drivers/xen/xenbus/xenbus_xs.c | 3 +++ 3 files changed, 5 insertions(+) --- a/drivers/xen/xenbus/xenbus.h +++ b/drivers/xen/xenbus/xenbus.h @@ -76,6 +76,7 @@ struct xb_req_data { struct list_head list; wait_queue_head_t wq; struct xsd_sockmsg msg; + uint32_t caller_req_id; enum xsd_sockmsg_type type; char *body; const struct kvec *vec; --- a/drivers/xen/xenbus/xenbus_comms.c +++ b/drivers/xen/xenbus/xenbus_comms.c @@ -309,6 +309,7 @@ static int process_msg(void) goto out; if (req->state == xb_req_state_wait_reply) { + req->msg.req_id = req->caller_req_id; req->msg.type = state.msg.type; req->msg.len = state.msg.len; req->body = state.body; --- a/drivers/xen/xenbus/xenbus_xs.c +++ b/drivers/xen/xenbus/xenbus_xs.c @@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data * req->state = xb_req_state_queued; init_waitqueue_head(&req->wq); + /* Save the caller req_id and restore it later in the reply */ + req->caller_req_id = req->msg.req_id; req->msg.req_id = xs_request_enter(req); mutex_lock(&xb_write_mutex); @@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_tran req->num_vecs = num_vecs; req->cb = xs_wake_up; + msg.req_id = 0; msg.tx_id = t.id; msg.type = type; msg.len = 0;