linux-kernel - [PATCH] Input: xen-kbdfront - free grant table entry in xenkbd_disconnect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1413016412-17890-1-git-send-email-hansechang@gmail.com>
Date:	Sat, 11 Oct 2014 16:33:32 +0800
From:	hansechang@...il.com
To:	linux-kernel@...r.kernel.org, xen-devel@...ts.xen.org
Cc:	Ian.Campbell@...citrix.com, dgdegra@...ho.nsa.gov,
	jinsong.liu@...baba-inc.com,
	Chang Huaixin <huaixin.chx@...baba-inc.com>
Subject: [PATCH] Input: xen-kbdfront - free grant table entry in xenkbd_disconnect_backend

From: Chang Huaixin <huaixin.chx@...baba-inc.com>

xenkbd_disconnect_backend doesn't free grant table entry.
This bug affects live migration.

xenkbd_disconnect_backend uses gnttab_end_foreign_access_ref
to handle grant table entry which doesn't really free an entry.

Thus every time we do xenkbd_resume, grant table entry increses
by one. As an grant table entry occupies 8 bytes, an grant table
page has at most 512 entries. Every 512 times we do xenkdb_resume,
grant table pages increses by one.

After around 3500 times of live migration, grant table pages
will increase by 7, causing too many pages to populate and hitting
max_pages limit when assigning pages.Thus assign_pages will fail,
so will live migration.

Signed-off-by: Chang Huaixin <huaixin.chx@...baba-inc.com>
---
 drivers/input/misc/xen-kbdfront.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index fbfdc10..e2ecfc6 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -285,7 +285,7 @@ static int xenkbd_connect_backend(struct xenbus_device *dev,
  error_evtchan:
 	xenbus_free_evtchn(dev, evtchn);
  error_grant:
-	gnttab_end_foreign_access_ref(info->gref, 0);
+	gnttab_end_foreign_access(info->gref, 0, 0UL);
 	info->gref = -1;
 	return ret;
 }
@@ -296,7 +296,7 @@ static void xenkbd_disconnect_backend(struct xenkbd_info *info)
 		unbind_from_irqhandler(info->irq, info);
 	info->irq = -1;
 	if (info->gref >= 0)
-		gnttab_end_foreign_access_ref(info->gref, 0);
+		gnttab_end_foreign_access(info->gref, 0, 0UL);
 	info->gref = -1;
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/