linux-kernel - Re: [PATCH v4 11/18] xen/pvcalls: implement accept command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1706211327210.12819@sstabellini-ThinkPad-X260>
Date:   Wed, 21 Jun 2017 13:29:53 -0700 (PDT)
From:   Stefano Stabellini <sstabellini@...nel.org>
To:     Boris Ostrovsky <boris.ostrovsky@...cle.com>
cc:     Stefano Stabellini <sstabellini@...nel.org>,
        xen-devel@...ts.xen.org, linux-kernel@...r.kernel.org,
        jgross@...e.com, Stefano Stabellini <stefano@...reto.com>
Subject: Re: [PATCH v4 11/18] xen/pvcalls: implement accept command

On Tue, 20 Jun 2017, Boris Ostrovsky wrote:
> >  static void __pvcalls_back_accept(struct work_struct *work)
> >  {
> > +	struct sockpass_mapping *mappass = container_of(
> > +		work, struct sockpass_mapping, register_work);
> > +	struct sock_mapping *map;
> > +	struct pvcalls_ioworker *iow;
> > +	struct pvcalls_fedata *fedata;
> > +	struct socket *sock;
> > +	struct xen_pvcalls_response *rsp;
> > +	struct xen_pvcalls_request *req;
> > +	int notify;
> > +	int ret = -EINVAL;
> > +	unsigned long flags;
> > +
> > +	fedata = mappass->fedata;
> > +	/*
> > +	 * __pvcalls_back_accept can race against pvcalls_back_accept.
> > +	 * We only need to check the value of "cmd" on read. It could be
> > +	 * done atomically, but to simplify the code on the write side, we
> > +	 * use a spinlock.
> > +	 */
> > +	spin_lock_irqsave(&mappass->copy_lock, flags);
> > +	req = &mappass->reqcopy;
> > +	if (req->cmd != PVCALLS_ACCEPT) {
> > +		spin_unlock_irqrestore(&mappass->copy_lock, flags);
> > +		return;
> > +	}
> > +	spin_unlock_irqrestore(&mappass->copy_lock, flags);
> > +
> > +	sock = sock_alloc();
> > +	if (sock == NULL)
> > +		goto out_error;
> > +	sock->type = mappass->sock->type;
> > +	sock->ops = mappass->sock->ops;
> > +
> > +	ret = inet_accept(mappass->sock, sock, O_NONBLOCK, true);
> > +	if (ret == -EAGAIN) {
> > +		sock_release(sock);
> > +		goto out_error;
> > +	}
> > +
> > +	map = pvcalls_new_active_socket(fedata,
> > +					req->u.accept.id_new,
> > +					req->u.accept.ref,
> > +					req->u.accept.evtchn,
> > +					sock);
> > +	if (!map) {
> > +		sock_release(sock);
> > +		goto out_error;
> 
> Again, lost ret value.

Yep, I'll fix


> > +	}
> > +
> > +	map->sockpass = mappass;
> > +	iow = &map->ioworker;
> > +	atomic_inc(&map->read);
> > +	atomic_inc(&map->io);
> > +	queue_work(iow->wq, &iow->register_work);
> > +
> > +out_error:
> > +	rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
> > +	rsp->req_id = req->req_id;
> > +	rsp->cmd = req->cmd;
> > +	rsp->u.accept.id = req->u.accept.id;
> > +	rsp->ret = ret;
> > +	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&fedata->ring, notify);
> > +	if (notify)
> > +		notify_remote_via_irq(fedata->irq);
> > +
> > +	mappass->reqcopy.cmd = 0;
> >  }
> >  
> >  static void pvcalls_pass_sk_data_ready(struct sock *sock)
> >  {
> > +	struct sockpass_mapping *mappass = sock->sk_user_data;
> > +
> > +	if (mappass == NULL)
> > +		return;
> > +
> > +	queue_work(mappass->wq, &mappass->register_work);
> >  }
> >  
> >  static int pvcalls_back_bind(struct xenbus_device *dev,
> > @@ -383,6 +456,43 @@ static int pvcalls_back_listen(struct xenbus_device *dev,
> >  static int pvcalls_back_accept(struct xenbus_device *dev,
> >  			       struct xen_pvcalls_request *req)
> >  {
> > +	struct pvcalls_fedata *fedata;
> > +	struct sockpass_mapping *mappass;
> > +	int ret = -EINVAL;
> 
> Unnecessary initialization.

It is not unnecessary: if mappass is NULL few lines below, it will goto
out_error without setting ret.


> > +	struct xen_pvcalls_response *rsp;
> > +	unsigned long flags;
> > +
> > +	fedata = dev_get_drvdata(&dev->dev);
> > +
> > +	mappass = radix_tree_lookup(&fedata->socketpass_mappings,
> > +		req->u.accept.id);
> > +	if (mappass == NULL)
> > +		goto out_error;
> > +
> > +	/* 
> > +	 * Limitation of the current implementation: only support one
> > +	 * concurrent accept or poll call on one socket.
> > +	 */
> > +	spin_lock_irqsave(&mappass->copy_lock, flags);
> > +	if (mappass->reqcopy.cmd != 0) {
> > +		spin_unlock_irqrestore(&mappass->copy_lock, flags);
> > +		ret = -EINTR;
> > +		goto out_error;
> > +	}
> > +
> > +	mappass->reqcopy = *req;
> > +	spin_unlock_irqrestore(&mappass->copy_lock, flags);
> > +	queue_work(mappass->wq, &mappass->register_work);
> > +
> > +	/* Tell the caller we don't need to send back a notification yet */
> > +	return -1;
> > +
> > +out_error:
> > +	rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
> > +	rsp->req_id = req->req_id;
> > +	rsp->cmd = req->cmd;
> > +	rsp->u.accept.id = req->u.accept.id;
> > +	rsp->ret = ret;
> >  	return 0;
> >  }
> >  
>