linux-kernel - Re: [Xen-devel] [PATCH] xenbus: don't BUG() on user mode induced condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Aug 2016 00:45:40 -0600
From:   "Jan Beulich" <JBeulich@...e.com>
To:     "Sylvain Munaut" <s.munaut@...tever-company.com>
Cc:     <david.vrabel@...rix.com>, <xen-devel@...ts.xenproject.org>,
        <boris.ostrovsky@...cle.com>, "Juergen Gross" <JGross@...e.com>,
        "LKML" <linux-kernel@...r.kernel.org>
Subject: Re: [Xen-devel] [PATCH] xenbus: don't BUG() on user mode
 induced condition

>>> On 21.08.16 at 21:36, <s.munaut@...tever-company.com> wrote:
>> --- 4.7-rc6-xen.orig/drivers/xen/xenbus/xenbus_dev_frontend.c
>> +++ 4.7-rc6-xen/drivers/xen/xenbus/xenbus_dev_frontend.c
>> @@ -316,11 +316,18 @@ static int xenbus_write_transaction(unsi
>>                         rc = -ENOMEM;
>>                         goto out;
>>                 }
>> +       } else {
>> +               list_for_each_entry(trans, &u->transactions, list)
>> +                       if (trans->handle.id == u->u.msg.tx_id)
>> +                               break;
>> +               if (&trans->list == &u->transactions)
>> +                       return -ESRCH;
>>         }
> 
> Shouldn't there be some tolerance in there in case the tx_id is zero ?
> (i.e. no transaction).
> 
> I'm trying to find out why just doing "xenstore-ls" doesn't work on my
> 4.4.20 kernel and when stracing it, I see it doing :
> 
> access("/dev/xen/xenbus", F_OK)         = 0
> stat("/dev/xen/xenbus", {st_mode=S_IFCHR|0600, st_rdev=makedev(10,
> 60), ...}) = 0
> open("/dev/xen/xenbus", O_RDWR)         = 3
> brk(0)                                  = 0x18e4000
> brk(0x1905000)                          = 0x1905000
> rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7fe4dd98e0e0},
> {SIG_DFL, [], 0}, 8) = 0
> write(3, "\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 16) = 16
> write(3, "/\0", 2)                      = -1 ESRCH (No such process)
> 
> 
> So either what xenstore-ls does is invalid, or that condition
> requiring a transaction is too strict.
> 
> Or am I missing something here ?

See https://patchwork.kernel.org/patch/9281193/.

Jan