aboutsummaryrefslogtreecommitdiffstats
path: root/main/xen
diff options
context:
space:
mode:
authorWilliam Pitcock <nenolod@dereferenced.org>2013-11-01 15:51:37 +0000
committerWilliam Pitcock <nenolod@dereferenced.org>2013-11-01 15:53:12 +0000
commit2295401d111c352c5278d2da3a5f386759e5edd2 (patch)
tree42755f2430561d8c069a6dcccf4af86d4e7e3f6f /main/xen
parentdaf5993294916c08aa15a155bbf5bd269924700f (diff)
downloadaports-2295401d111c352c5278d2da3a5f386759e5edd2.tar.bz2
aports-2295401d111c352c5278d2da3a5f386759e5edd2.tar.xz
main/xen: add XSA-73 patch
Diffstat (limited to 'main/xen')
-rw-r--r--main/xen/APKBUILD7
-rw-r--r--main/xen/xsa73-4_3-unstable.patch105
2 files changed, 111 insertions, 1 deletions
diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD
index 300161fe65..a9cae4cbde 100644
--- a/main/xen/APKBUILD
+++ b/main/xen/APKBUILD
@@ -3,7 +3,7 @@
# Maintainer: William Pitcock <nenolod@dereferenced.org>
pkgname=xen
pkgver=4.3.0
-pkgrel=6
+pkgrel=7
pkgdesc="Xen hypervisor"
url="http://www.xen.org/"
arch="x86_64"
@@ -25,6 +25,8 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
xsa41c.patch
xsa48-4.2.patch
+ xsa73-4_3-unstable.patch
+
fix-pod2man-choking.patch
qemu-xen-websocket.patch
@@ -192,6 +194,7 @@ md5sums="7b18cfb58f1ac2ce39cf35a1867f0c0a xen-4.3.0.tar.gz
ed7d0399c6ca6aeee479da5d8f807fe0 xsa41b.patch
2f3dd7bdc59d104370066d6582725575 xsa41c.patch
b3e3a57d189a4f86c9766eaf3b5207f4 xsa48-4.2.patch
+5005efdb8bf44ccc2ce869611b507c83 xsa73-4_3-unstable.patch
4c5455d1adc09752a835e241097fbc39 fix-pod2man-choking.patch
a4097e06a7e000ed00f4607db014d277 qemu-xen-websocket.patch
35bdea1d4e3ae2565edc7e40906efdd5 qemu-xen-tls-websockets.patch
@@ -219,6 +222,7 @@ a0c225d716d343fe041b63e3940900c5b3573ed3bcfc5b7c2d52ea2861c3fc28 docs-Fix-gener
896a07f57310c9bea9bc2a305166cf796282c381cb7839be49105b1726a860b5 xsa41b.patch
683dd96a0a8899f794070c8c09643dfeeb39f92da531955cba961b45f6075914 xsa41c.patch
dc23077028584e71a08dd0dc9e81552c76744a5ce9d39df5958a95ae9cf3107b xsa48-4.2.patch
+48411cd6b15e4e4fa3c4335298179a4b1094c5e1ae8dc7582bbfb9439d97037b xsa73-4_3-unstable.patch
fcb5b9ff0bc4b4d39fed9b88891491b91628aa449914cfea321abe5da24c1da2 fix-pod2man-choking.patch
e9f6c482fc449e0b540657a8988ad31f2e680b8933e50e6486687a52f6a9ed04 qemu-xen-websocket.patch
435dd428d83acdfde58888532a1cece1e9075b2a2460fe3f6cd33c7d400f2715 qemu-xen-tls-websockets.patch
@@ -246,6 +250,7 @@ sha512sums="e6b8f64e15e48704ea5cee5585cd6151fe6a5a62bc4670caf0b762c1aa71c9598db2
bda9105793f2327e1317991762120d0668af0e964076b18c9fdbfd509984b2e88d85df95702c46b2e00d5350e8113f6aa7b34b19064d19abbeb4d43f0c431d38 xsa41b.patch
36b60478660ff7748328f5ab9adff13286eee1a1bad06e42fdf7e6aafe105103988525725aacd660cf5b2a184a9e2d6b3818655203c1fa07e07dcebdf23f35d9 xsa41c.patch
31dd8c62d41cc0a01a79d9b24a5b793f5e2058230808d9c5364c6ff3477ab02f3258f1bbd761d97dc1b97ee120b41524b999eaac77f33b606496fc324b5fa2e4 xsa48-4.2.patch
+8eb555bc589bc4848f640dd93bdfaf0d0a61667e26667ff2ff89ab60c8c5a777982647e8c440be7510620281bac8d9bb3281afcae36e974f09bd70184ba6ba9a xsa73-4_3-unstable.patch
2e95ad43bb66f928fe1e8caf474a3211571f75f79ea32aaa3eddb3aed9963444bd131006b67e682395af0d79118b2634bf808404693b813a94662d2a9d665ac2 fix-pod2man-choking.patch
45f1da45f3ff937d0a626e37c130d76f5b97f49a57ddeb11ef2a8e850c04c32c819a3dfcef501eb3784db5fe7b39c88230063e56aa6e5197fd9c7b7d424fff77 qemu-xen-websocket.patch
11eaccc346440ff285552f204d491e3b31bda1665c3219ecae3061b5d55db9dec885af0c031fa19c67e87bbe238002b1911bbd5bfea2f2ba0d61e6b3d0c952c9 qemu-xen-tls-websockets.patch
diff --git a/main/xen/xsa73-4_3-unstable.patch b/main/xen/xsa73-4_3-unstable.patch
new file mode 100644
index 0000000000..efa64f9b17
--- /dev/null
+++ b/main/xen/xsa73-4_3-unstable.patch
@@ -0,0 +1,105 @@
+From 068bfa76bbd52430e65853375e1d5db99d193e2f Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Thu, 31 Oct 2013 20:49:00 +0000
+Subject: [PATCH] gnttab: correct locking order reversal
+
+Coverity ID 1087189
+
+Correct a lock order reversal between a domains page allocation and grant
+table locks.
+
+This is XSA-73.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+Consolidate error handling.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Keir Fraser <keir@xen.org>
+Tested-by: Matthew Daley <mattjd@gmail.com>
+---
+ xen/common/grant_table.c | 52 +++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 44 insertions(+), 8 deletions(-)
+
+diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
+index f42bc7a..48df928 100644
+--- a/xen/common/grant_table.c
++++ b/xen/common/grant_table.c
+@@ -1517,6 +1517,8 @@ gnttab_transfer(
+
+ for ( i = 0; i < count; i++ )
+ {
++ bool_t okay;
++
+ if (i && hypercall_preempt_check())
+ return i;
+
+@@ -1625,16 +1627,18 @@ gnttab_transfer(
+ * pages when it is dying.
+ */
+ if ( unlikely(e->is_dying) ||
+- unlikely(e->tot_pages >= e->max_pages) ||
+- unlikely(!gnttab_prepare_for_transfer(e, d, gop.ref)) )
++ unlikely(e->tot_pages >= e->max_pages) )
+ {
+- if ( !e->is_dying )
+- gdprintk(XENLOG_INFO, "gnttab_transfer: "
+- "Transferee has no reservation "
+- "headroom (%d,%d) or provided a bad grant ref (%08x) "
+- "or is dying (%d)\n",
+- e->tot_pages, e->max_pages, gop.ref, e->is_dying);
+ spin_unlock(&e->page_alloc_lock);
++
++ if ( e->is_dying )
++ gdprintk(XENLOG_INFO, "gnttab_transfer: "
++ "Transferee (d%d) is dying\n", e->domain_id);
++ else
++ gdprintk(XENLOG_INFO, "gnttab_transfer: "
++ "Transferee (d%d) has no headroom (tot %u, max %u)\n",
++ e->domain_id, e->tot_pages, e->max_pages);
++
+ rcu_unlock_domain(e);
+ put_gfn(d, gop.mfn);
+ page->count_info &= ~(PGC_count_mask|PGC_allocated);
+@@ -1646,6 +1650,38 @@ gnttab_transfer(
+ /* Okay, add the page to 'e'. */
+ if ( unlikely(domain_adjust_tot_pages(e, 1) == 1) )
+ get_knownalive_domain(e);
++
++ /*
++ * We must drop the lock to avoid a possible deadlock in
++ * gnttab_prepare_for_transfer. We have reserved a page in e so can
++ * safely drop the lock and re-aquire it later to add page to the
++ * pagelist.
++ */
++ spin_unlock(&e->page_alloc_lock);
++ okay = gnttab_prepare_for_transfer(e, d, gop.ref);
++ spin_lock(&e->page_alloc_lock);
++
++ if ( unlikely(!okay) || unlikely(e->is_dying) )
++ {
++ bool_t drop_dom_ref = (domain_adjust_tot_pages(e, -1) == 0);
++
++ spin_unlock(&e->page_alloc_lock);
++
++ if ( okay /* i.e. e->is_dying due to the surrounding if() */ )
++ gdprintk(XENLOG_INFO, "gnttab_transfer: "
++ "Transferee (d%d) is now dying\n", e->domain_id);
++
++ if ( drop_dom_ref )
++ put_domain(e);
++ rcu_unlock_domain(e);
++
++ put_gfn(d, gop.mfn);
++ page->count_info &= ~(PGC_count_mask|PGC_allocated);
++ free_domheap_page(page);
++ gop.status = GNTST_general_error;
++ goto copyback;
++ }
++
+ page_list_add_tail(page, &e->page_list);
+ page_set_owner(page, e);
+
+--
+1.7.10.4
+