releases/4.14.21/xenbus-track-caller-request-id.patch

   1 From 29fee6eed2811ff1089b30fc579a2d19d78016ab Mon Sep 17 00:00:00 2001
   2 From: Joao Martins <joao.m.martins@oracle.com>
   3 Date: Fri, 2 Feb 2018 17:42:33 +0000
   4 Subject: xenbus: track caller request id
   5
   6 From: Joao Martins <joao.m.martins@oracle.com>
   7
   8 commit 29fee6eed2811ff1089b30fc579a2d19d78016ab upstream.
   9
  10 Commit fd8aa9095a95 ("xen: optimize xenbus driver for multiple concurrent
  11 xenstore accesses") optimized xenbus concurrent accesses but in doing so
  12 broke UABI of /dev/xen/xenbus. Through /dev/xen/xenbus applications are in
  13 charge of xenbus message exchange with the correct header and body. Now,
  14 after the mentioned commit the replies received by application will no
  15 longer have the header req_id echoed back as it was on request (see
  16 specification below for reference), because that particular field is being
  17 overwritten by kernel.
  18
  19 struct xsd_sockmsg
  20 {
  21   uint32_t type;  /* XS_??? */
  22   uint32_t req_id;/* Request identifier, echoed in daemon's response.  */
  23   uint32_t tx_id; /* Transaction id (0 if not related to a transaction). */
  24   uint32_t len;   /* Length of data following this. */
  25
  26   /* Generally followed by nul-terminated string(s). */
  27 };
  28
  29 Before there was only one request at a time so req_id could simply be
  30 forwarded back and forth. To allow simultaneous requests we need a
  31 different req_id for each message thus kernel keeps a monotonic increasing
  32 counter for this field and is written on every request irrespective of
  33 userspace value.
  34
  35 Forwarding again the req_id on userspace requests is not a solution because
  36 we would open the possibility of userspace-generated req_id colliding with
  37 kernel ones. So this patch instead takes another route which is to
  38 artificially keep user req_id while keeping the xenbus logic as is. We do
  39 that by saving the original req_id before xs_send(), use the private kernel
  40 counter as req_id and then once reply comes and was validated, we restore
  41 back the original req_id.
  42
  43 Cc: <stable@vger.kernel.org> # 4.11
  44 Fixes: fd8aa9095a ("xen: optimize xenbus driver for multiple concurrent xenstore accesses")
  45 Reported-by: Bhavesh Davda <bhavesh.davda@oracle.com>
  46 Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
  47 Reviewed-by: Juergen Gross <jgross@suse.com>
  48 Signed-off-by: Juergen Gross <jgross@suse.com>
  49 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  50
  51 ---
  52  drivers/xen/xenbus/xenbus.h       |    1 +
  53  drivers/xen/xenbus/xenbus_comms.c |    1 +
  54  drivers/xen/xenbus/xenbus_xs.c    |    3 +++
  55  3 files changed, 5 insertions(+)
  56
  57 --- a/drivers/xen/xenbus/xenbus.h
  58 +++ b/drivers/xen/xenbus/xenbus.h
  59 @@ -76,6 +76,7 @@ struct xb_req_data {
  60         struct list_head list;
  61         wait_queue_head_t wq;
  62         struct xsd_sockmsg msg;
  63 +       uint32_t caller_req_id;
  64         enum xsd_sockmsg_type type;
  65         char *body;
  66         const struct kvec *vec;
  67 --- a/drivers/xen/xenbus/xenbus_comms.c
  68 +++ b/drivers/xen/xenbus/xenbus_comms.c
  69 @@ -309,6 +309,7 @@ static int process_msg(void)
  70                         goto out;
  71
  72                 if (req->state == xb_req_state_wait_reply) {
  73 +                       req->msg.req_id = req->caller_req_id;
  74                         req->msg.type = state.msg.type;
  75                         req->msg.len = state.msg.len;
  76                         req->body = state.body;
  77 --- a/drivers/xen/xenbus/xenbus_xs.c
  78 +++ b/drivers/xen/xenbus/xenbus_xs.c
  79 @@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *
  80         req->state = xb_req_state_queued;
  81         init_waitqueue_head(&req->wq);
  82
  83 +       /* Save the caller req_id and restore it later in the reply */
  84 +       req->caller_req_id = req->msg.req_id;
  85         req->msg.req_id = xs_request_enter(req);
  86
  87         mutex_lock(&xb_write_mutex);
  88 @@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_tran
  89         req->num_vecs = num_vecs;
  90         req->cb = xs_wake_up;
  91
  92 +       msg.req_id = 0;
  93         msg.tx_id = t.id;
  94         msg.type = type;
  95         msg.len = 0;