[lkml]   [2016]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 3.2 26/70] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled
    3.2.76-rc1 review patch.  If anyone has any objections, please let me know.


    From: Konrad Rzeszutek Wilk <>

    commit 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9 upstream.

    The guest sequence of:

    a) XEN_PCI_OP_enable_msix
    b) XEN_PCI_OP_enable_msix

    results in hitting an NULL pointer due to using freed pointers.

    The device passed in the guest MUST have MSI-X capability.

    The a) constructs and SysFS representation of MSI and MSI groups.
    The b) adds a second set of them but adding in to SysFS fails (duplicate entry).
    'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that
    in a) pdev->msi_irq_groups is still set) and also free's ALL of the
    MSI-X entries of the device (the ones allocated in step a) and b)).

    The unwind code: 'free_msi_irqs' deletes all the entries and tries to
    delete the pdev->msi_irq_groups (which hasn't been set to NULL).
    However the pointers in the SysFS are already freed and we hit an
    NULL pointer further on when 'strlen' is attempted on a freed pointer.

    The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard
    against that. The check for msi_enabled is not stricly neccessary.

    This is part of XSA-157

    Reviewed-by: David Vrabel <>
    Reviewed-by: Jan Beulich <>
    Signed-off-by: Konrad Rzeszutek Wilk <>
    Signed-off-by: Ben Hutchings <>
    drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
    1 file changed, 7 insertions(+)

    --- a/drivers/xen/xen-pciback/pciback_ops.c
    +++ b/drivers/xen/xen-pciback/pciback_ops.c
    @@ -204,9 +204,16 @@ int xen_pcibk_enable_msix(struct xen_pci
    if (unlikely(verbose_request))
    printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
    if (op->value > SH_INFO_MAX_VEC)
    return -EINVAL;

    + if (dev->msix_enabled)
    + return -EALREADY;
    + if (dev->msi_enabled)
    + return -ENXIO;
    entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
    if (entries == NULL)
    return -ENOMEM;

     \ /
      Last update: 2016-01-18 05:01    [W:2.835 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site