[Xen-changelog] [xen-unstable] Only allow DOMCTL_max_vcpus to increase vcpus from zero.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1245751829 -3600
# Node ID 468561f3c8ee05cf5b2bcdc244741b359302f32b
# Parent  703ced548925c50cd88598b5e1e8cd774f91b33b
Only allow DOMCTL_max_vcpus to increase vcpus from zero.

Otherwise reallocation of the vcpus array is unsafe.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx>
Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxx>
---
 xen/common/domctl.c |   32 +++++++++++++++++++++-----------
 1 files changed, 21 insertions(+), 11 deletions(-)

diff -r 703ced548925 -r 468561f3c8ee xen/common/domctl.c
--- a/xen/common/domctl.c       Fri Jun 19 08:45:55 2009 +0100
+++ b/xen/common/domctl.c       Tue Jun 23 11:10:29 2009 +0100
@@ -463,24 +463,34 @@ long do_domctl(XEN_GUEST_HANDLE(xen_domc
         if ( (max < d->max_vcpus) && (d->vcpu[max] != NULL) )
             goto maxvcpu_out;
 
+        /*
+         * For now don't allow increasing the vcpu count from a non-zero
+         * value: This code and all readers of d->vcpu would otherwise need
+         * to be converted to use RCU, but at present there's no tools side
+         * code path that would issue such a request.
+         */
+        ret = -EBUSY;
+        if ( (d->max_vcpus > 0) && (max > d->max_vcpus) )
+            goto maxvcpu_out;
+
         ret = -ENOMEM;
         if ( max > d->max_vcpus )
         {
-            struct vcpu **vcpus = xmalloc_array(struct vcpu *, max);
-            void *ptr;
-
-            if ( !vcpus )
+            struct vcpu **vcpus;
+
+            BUG_ON(d->vcpu != NULL);
+            BUG_ON(d->max_vcpus != 0);
+
+            if ( (vcpus = xmalloc_array(struct vcpu *, max)) == NULL )
                 goto maxvcpu_out;
-            memcpy(vcpus, d->vcpu, d->max_vcpus * sizeof(*vcpus));
-            memset(vcpus + d->max_vcpus, 0,
-                   (max - d->max_vcpus) * sizeof(*vcpus));
-
-            ptr = d->vcpu;
+            memset(vcpus, 0, max * sizeof(*vcpus));
+
+            /* Install vcpu array /then/ update max_vcpus. */
             d->vcpu = vcpus;
             wmb();
             d->max_vcpus = max;
-            xfree(ptr);
-        }
+        }
+
         for ( i = 0; i < max; i++ )
         {
             if ( d->vcpu[i] != NULL )

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog