Re: [Xen-devel] [PATCH] xen/blkback: fix reference counting

[Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>]

On Thu, Sep 05, 2013 at 01:00:14PM +0200, Vegard Nossum wrote:
> If the permission check fails, we drop a reference to the blkif without
> having taken it in the first place. The bug was introduced in commit
> 604c499cbbcc3d5fe5fb8d53306aa0fae1990109 (xen/blkback: Check device
> permissions before allowing OP_DISCARD).
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Jan Beulich <JBeulich@xxxxxxxx>
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>

Thank you for spotting that. Let me stick it on my for-jens queue.

> Signed-off-by: Vegard Nossum <vegard.nossum@xxxxxxxxxx>
> ---
>  drivers/block/xen-blkback/blkback.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/block/xen-blkback/blkback.c 
> b/drivers/block/xen-blkback/blkback.c
> index bf4b9d2..6620b73 100644
> --- a/drivers/block/xen-blkback/blkback.c
> +++ b/drivers/block/xen-blkback/blkback.c
> @@ -872,49 +872,50 @@ static int xen_blkbk_parse_indirect(struct 
> blkif_request *req,
>       }
>  
>  unmap:
>       if (segments)
>               kunmap_atomic(segments);
>       xen_blkbk_unmap(blkif, pages, indirect_grefs);
>       return rc;
>  }
>  
>  static int dispatch_discard_io(struct xen_blkif *blkif,
>                               struct blkif_request *req)
>  {
>       int err = 0;
>       int status = BLKIF_RSP_OKAY;
>       struct block_device *bdev = blkif->vbd.bdev;
>       unsigned long secure;
>       struct phys_req preq;
>  
> +     xen_blkif_get(blkif);
> +
>       preq.sector_number = req->u.discard.sector_number;
>       preq.nr_sects      = req->u.discard.nr_sectors;
>  
>       err = xen_vbd_translate(&preq, blkif, WRITE);
>       if (err) {
>               pr_warn(DRV_PFX "access denied: DISCARD [%llu->%llu] on 
> dev=%04x\n",
>                       preq.sector_number,
>                       preq.sector_number + preq.nr_sects, blkif->vbd.pdevice);
>               goto fail_response;
>       }
>       blkif->st_ds_req++;
>  
> -     xen_blkif_get(blkif);
>       secure = (blkif->vbd.discard_secure &&
>                (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
>                BLKDEV_DISCARD_SECURE : 0;
>  
>       err = blkdev_issue_discard(bdev, req->u.discard.sector_number,
>                                  req->u.discard.nr_sectors,
>                                  GFP_KERNEL, secure);
>  fail_response:
>       if (err == -EOPNOTSUPP) {
>               pr_debug(DRV_PFX "discard op failed, not supported\n");
>               status = BLKIF_RSP_EOPNOTSUPP;
>       } else if (err)
>               status = BLKIF_RSP_ERROR;
>  
>       make_response(blkif, req->u.discard.id, req->operation, status);
>       xen_blkif_put(blkif);
>       return err;
>  }
> -- 
> 1.7.10.4
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel