linux-kernel - Re: [Xen-devel] [PATCH] xen/scsifront: don't advance ring request pointer in case of error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <de9639d9-620a-beac-7a58-14939c2baa0f@citrix.com>
Date:   Tue, 29 Nov 2016 11:28:39 +0000
From:   David Vrabel <david.vrabel@...rix.com>
To:     Juergen Gross <jgross@...e.com>, Jan Beulich <JBeulich@...e.com>
CC:     <jejb@...ux.vnet.ibm.com>, <linux-scsi@...r.kernel.org>,
        <martin.petersen@...cle.com>, <lambert.quentin@...il.com>,
        <linux-kernel@...r.kernel.org>, <xen-devel@...ts.xenproject.org>,
        <boris.ostrovsky@...cle.com>, <dan.carpenter@...cle.com>
Subject: Re: [Xen-devel] [PATCH] xen/scsifront: don't advance ring request
 pointer in case of error

On 29/11/16 11:19, Juergen Gross wrote:
> On 29/11/16 12:14, Jan Beulich wrote:
>>>>> On 29.11.16 at 11:50, <JGross@...e.com> wrote:
>>> --- a/drivers/scsi/xen-scsifront.c
>>> +++ b/drivers/scsi/xen-scsifront.c
>>> @@ -184,8 +184,6 @@ static struct vscsiif_request *scsifront_pre_req(struct vscsifrnt_info *info)
>>>  
>>>  	ring_req = RING_GET_REQUEST(&(info->ring), ring->req_prod_pvt);
>>>  
>>> -	ring->req_prod_pvt++;
>>
>> Please note the "_pvt" suffix, which stands for "private": This field is
>> not visible to the backend. Only ring->sring fields are shared, and
>> the updating of the shared field happens in RING_PUSH_REQUESTS()
>> and RING_PUSH_REQUESTS_AND_CHECK_NOTIFY().
> 
> Sure, but RING_PUSH_REQUESTS() will copy req_prod_pvt to req_prod. In
> the case corrected this would advance req_prod by two after the error
> case before, even if only one request would have made it to the ring.
> 
> As an alternative I could have decremented req_prod_pvt in case of an
> error, but I like my current solution better.

FWIW, I found the commit message a bit misleading and also came to the
same conclusion as Jan initially.

Perhaps,

"When adding a new request to the ring, an error may cause the
(partially constructed) request to be discarded and used for the next.
Thus ring->req_prod_pvt should not be advanced until we know the request
will be successfully added to the ring."

Or similar.

David