main/xen: add XSA-73 patch

2 files changed, 111 insertions, 1 deletions

diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD
index 300161fe65..a9cae4cbde 100644
--- a/main/xen/APKBUILD
+++ b/main/xen/APKBUILD
@@ -3,7 +3,7 @@
 # Maintainer: William Pitcock <nenolod@dereferenced.org>
 pkgname=xen
 pkgver=4.3.0
-pkgrel=6
+pkgrel=7
 pkgdesc="Xen hypervisor"
 url="http://www.xen.org/"
 arch="x86_64"
@@ -25,6 +25,8 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
 	xsa41c.patch
 	xsa48-4.2.patch
 
+	xsa73-4_3-unstable.patch
+
 	fix-pod2man-choking.patch
 
 	qemu-xen-websocket.patch
@@ -192,6 +194,7 @@ md5sums="7b18cfb58f1ac2ce39cf35a1867f0c0a  xen-4.3.0.tar.gz
 ed7d0399c6ca6aeee479da5d8f807fe0  xsa41b.patch
 2f3dd7bdc59d104370066d6582725575  xsa41c.patch
 b3e3a57d189a4f86c9766eaf3b5207f4  xsa48-4.2.patch
+5005efdb8bf44ccc2ce869611b507c83  xsa73-4_3-unstable.patch
 4c5455d1adc09752a835e241097fbc39  fix-pod2man-choking.patch
 a4097e06a7e000ed00f4607db014d277  qemu-xen-websocket.patch
 35bdea1d4e3ae2565edc7e40906efdd5  qemu-xen-tls-websockets.patch
@@ -219,6 +222,7 @@ a0c225d716d343fe041b63e3940900c5b3573ed3bcfc5b7c2d52ea2861c3fc28  docs-Fix-gener
 896a07f57310c9bea9bc2a305166cf796282c381cb7839be49105b1726a860b5  xsa41b.patch
 683dd96a0a8899f794070c8c09643dfeeb39f92da531955cba961b45f6075914  xsa41c.patch
 dc23077028584e71a08dd0dc9e81552c76744a5ce9d39df5958a95ae9cf3107b  xsa48-4.2.patch
+48411cd6b15e4e4fa3c4335298179a4b1094c5e1ae8dc7582bbfb9439d97037b  xsa73-4_3-unstable.patch
 fcb5b9ff0bc4b4d39fed9b88891491b91628aa449914cfea321abe5da24c1da2  fix-pod2man-choking.patch
 e9f6c482fc449e0b540657a8988ad31f2e680b8933e50e6486687a52f6a9ed04  qemu-xen-websocket.patch
 435dd428d83acdfde58888532a1cece1e9075b2a2460fe3f6cd33c7d400f2715  qemu-xen-tls-websockets.patch
@@ -246,6 +250,7 @@ sha512sums="e6b8f64e15e48704ea5cee5585cd6151fe6a5a62bc4670caf0b762c1aa71c9598db2
 bda9105793f2327e1317991762120d0668af0e964076b18c9fdbfd509984b2e88d85df95702c46b2e00d5350e8113f6aa7b34b19064d19abbeb4d43f0c431d38  xsa41b.patch
 36b60478660ff7748328f5ab9adff13286eee1a1bad06e42fdf7e6aafe105103988525725aacd660cf5b2a184a9e2d6b3818655203c1fa07e07dcebdf23f35d9  xsa41c.patch
 31dd8c62d41cc0a01a79d9b24a5b793f5e2058230808d9c5364c6ff3477ab02f3258f1bbd761d97dc1b97ee120b41524b999eaac77f33b606496fc324b5fa2e4  xsa48-4.2.patch
+8eb555bc589bc4848f640dd93bdfaf0d0a61667e26667ff2ff89ab60c8c5a777982647e8c440be7510620281bac8d9bb3281afcae36e974f09bd70184ba6ba9a  xsa73-4_3-unstable.patch
 2e95ad43bb66f928fe1e8caf474a3211571f75f79ea32aaa3eddb3aed9963444bd131006b67e682395af0d79118b2634bf808404693b813a94662d2a9d665ac2  fix-pod2man-choking.patch
 45f1da45f3ff937d0a626e37c130d76f5b97f49a57ddeb11ef2a8e850c04c32c819a3dfcef501eb3784db5fe7b39c88230063e56aa6e5197fd9c7b7d424fff77  qemu-xen-websocket.patch
 11eaccc346440ff285552f204d491e3b31bda1665c3219ecae3061b5d55db9dec885af0c031fa19c67e87bbe238002b1911bbd5bfea2f2ba0d61e6b3d0c952c9  qemu-xen-tls-websockets.patch
diff --git a/main/xen/xsa73-4_3-unstable.patch b/main/xen/xsa73-4_3-unstable.patch
new file mode 100644
index 0000000000..efa64f9b17
--- /dev/null
+++ b/main/xen/xsa73-4_3-unstable.patch
@@ -0,0 +1,105 @@
+From 068bfa76bbd52430e65853375e1d5db99d193e2f Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Thu, 31 Oct 2013 20:49:00 +0000
+Subject: [PATCH] gnttab: correct locking order reversal
+
+Coverity ID 1087189
+
+Correct a lock order reversal between a domains page allocation and grant
+table locks.
+
+This is XSA-73.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+Consolidate error handling.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Keir Fraser <keir@xen.org>
+Tested-by: Matthew Daley <mattjd@gmail.com>
+---
+ xen/common/grant_table.c |   52 +++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 44 insertions(+), 8 deletions(-)
+
+diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
+index f42bc7a..48df928 100644
+--- a/xen/common/grant_table.c
++++ b/xen/common/grant_table.c
+@@ -1517,6 +1517,8 @@ gnttab_transfer(
+ 
+     for ( i = 0; i < count; i++ )
+     {
++        bool_t okay;
++
+         if (i && hypercall_preempt_check())
+             return i;
+ 
+@@ -1625,16 +1627,18 @@ gnttab_transfer(
+          * pages when it is dying.
+          */
+         if ( unlikely(e->is_dying) ||
+-             unlikely(e->tot_pages >= e->max_pages) ||
+-             unlikely(!gnttab_prepare_for_transfer(e, d, gop.ref)) )
++             unlikely(e->tot_pages >= e->max_pages) )
+         {
+-            if ( !e->is_dying )
+-                gdprintk(XENLOG_INFO, "gnttab_transfer: "
+-                        "Transferee has no reservation "
+-                        "headroom (%d,%d) or provided a bad grant ref (%08x) "
+-                        "or is dying (%d)\n",
+-                        e->tot_pages, e->max_pages, gop.ref, e->is_dying);
+             spin_unlock(&e->page_alloc_lock);
++
++            if ( e->is_dying )
++                gdprintk(XENLOG_INFO, "gnttab_transfer: "
++                         "Transferee (d%d) is dying\n", e->domain_id);
++            else
++                gdprintk(XENLOG_INFO, "gnttab_transfer: "
++                         "Transferee (d%d) has no headroom (tot %u, max %u)\n",
++                         e->domain_id, e->tot_pages, e->max_pages);
++
+             rcu_unlock_domain(e);
+             put_gfn(d, gop.mfn);
+             page->count_info &= ~(PGC_count_mask|PGC_allocated);
+@@ -1646,6 +1650,38 @@ gnttab_transfer(
+         /* Okay, add the page to 'e'. */
+         if ( unlikely(domain_adjust_tot_pages(e, 1) == 1) )
+             get_knownalive_domain(e);
++
++        /*
++         * We must drop the lock to avoid a possible deadlock in
++         * gnttab_prepare_for_transfer.  We have reserved a page in e so can
++         * safely drop the lock and re-aquire it later to add page to the
++         * pagelist.
++         */
++        spin_unlock(&e->page_alloc_lock);
++        okay = gnttab_prepare_for_transfer(e, d, gop.ref);
++        spin_lock(&e->page_alloc_lock);
++
++        if ( unlikely(!okay) || unlikely(e->is_dying) )
++        {
++            bool_t drop_dom_ref = (domain_adjust_tot_pages(e, -1) == 0);
++
++            spin_unlock(&e->page_alloc_lock);
++
++            if ( okay /* i.e. e->is_dying due to the surrounding if() */ )
++                gdprintk(XENLOG_INFO, "gnttab_transfer: "
++                         "Transferee (d%d) is now dying\n", e->domain_id);
++
++            if ( drop_dom_ref )
++                put_domain(e);
++            rcu_unlock_domain(e);
++
++            put_gfn(d, gop.mfn);
++            page->count_info &= ~(PGC_count_mask|PGC_allocated);
++            free_domheap_page(page);
++            gop.status = GNTST_general_error;
++            goto copyback;
++        }
++
+         page_list_add_tail(page, &e->page_list);
+         page_set_owner(page, e);
+ 
+-- 
+1.7.10.4
+