linux-kernel - Re: [Xen-devel] [PATCH] xenbus: don't BUG() on user mode induced condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 21 Aug 2016 21:36:24 +0200
From:   Sylvain Munaut <s.munaut@...tever-company.com>
To:     Jan Beulich <JBeulich@...e.com>
Cc:     david.vrabel@...rix.com, boris.ostrovsky@...cle.com,
        Juergen Gross <JGross@...e.com>,
        xen-devel@...ts.xenproject.org, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [Xen-devel] [PATCH] xenbus: don't BUG() on user mode induced condition

Hi,

> --- 4.7-rc6-xen.orig/drivers/xen/xenbus/xenbus_dev_frontend.c
> +++ 4.7-rc6-xen/drivers/xen/xenbus/xenbus_dev_frontend.c
> @@ -316,11 +316,18 @@ static int xenbus_write_transaction(unsi
>                         rc = -ENOMEM;
>                         goto out;
>                 }
> +       } else {
> +               list_for_each_entry(trans, &u->transactions, list)
> +                       if (trans->handle.id == u->u.msg.tx_id)
> +                               break;
> +               if (&trans->list == &u->transactions)
> +                       return -ESRCH;
>         }

Shouldn't there be some tolerance in there in case the tx_id is zero ?
(i.e. no transaction).

I'm trying to find out why just doing "xenstore-ls" doesn't work on my
4.4.20 kernel and when stracing it, I see it doing :

access("/dev/xen/xenbus", F_OK)         = 0
stat("/dev/xen/xenbus", {st_mode=S_IFCHR|0600, st_rdev=makedev(10,
60), ...}) = 0
open("/dev/xen/xenbus", O_RDWR)         = 3
brk(0)                                  = 0x18e4000
brk(0x1905000)                          = 0x1905000
rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7fe4dd98e0e0},
{SIG_DFL, [], 0}, 8) = 0
write(3, "\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 16) = 16
write(3, "/\0", 2)                      = -1 ESRCH (No such process)


So either what xenstore-ls does is invalid, or that condition
requiring a transaction is too strict.

Or am I missing something here ?


Cheers,

    Sylvain Munaut