Commit 9996bd49 authored by SeongJae Park's avatar SeongJae Park Committed by Juergen Gross

xenbus/xenbus_backend: Disallow pending watch messages

'xenbus_backend' watches 'state' of devices, which is writable by
guests.  Hence, if guests intensively updates it, dom0 will have lots of
pending events that exhausting memory of dom0.  In other words, guests
can trigger dom0 memory pressure.  This is known as XSA-349.  However,
the watch callback of it, 'frontend_changed()', reads only 'state', so
doesn't need to have the pending events.

To avoid the problem, this commit disallows pending watch messages for
'xenbus_backend' using the 'will_handle()' watch callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: default avatarSeongJae Park <sjpark@amazon.de>
Reported-by: default avatarMichael Kurth <mku@amazon.de>
Reported-by: default avatarPawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
parent 3dc86ca6
...@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct xen_bus_type *bus, const char *type, ...@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct xen_bus_type *bus, const char *type,
return err; return err;
} }
static bool frontend_will_handle(struct xenbus_watch *watch,
const char *path, const char *token)
{
return watch->nr_pending == 0;
}
static void frontend_changed(struct xenbus_watch *watch, static void frontend_changed(struct xenbus_watch *watch,
const char *path, const char *token) const char *path, const char *token)
{ {
...@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backend = { ...@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backend = {
.levels = 3, /* backend/type/<frontend>/<id> */ .levels = 3, /* backend/type/<frontend>/<id> */
.get_bus_id = backend_bus_id, .get_bus_id = backend_bus_id,
.probe = xenbus_probe_backend, .probe = xenbus_probe_backend,
.otherend_will_handle = frontend_will_handle,
.otherend_changed = frontend_changed, .otherend_changed = frontend_changed,
.bus = { .bus = {
.name = "xen-backend", .name = "xen-backend",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment