Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus-6.15a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
- A fix for the xenbus driver allowing to use a PVH Dom0 with
Xenstore running in another domain
- A fix for the xenbus driver addressing a rare race condition
resulting in NULL dereferences and other problems
- A fix for the xen-swiotlb driver fixing a problem seen on Arm
platforms
* tag 'for-linus-6.15a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xenbus: Use kref to track req lifetime
xenbus: Allow PVH dom0 a non-local xenstore
xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
+32
-14
+1
drivers/xen/swiotlb-xen.c
+1
drivers/xen/swiotlb-xen.c
+2
drivers/xen/xenbus/xenbus.h
+2
drivers/xen/xenbus/xenbus.h
···
77
77
struct xb_req_data {
78
78
struct list_head list;
79
79
wait_queue_head_t wq;
80
+
struct kref kref;
80
81
struct xsd_sockmsg msg;
81
82
uint32_t caller_req_id;
82
83
enum xsd_sockmsg_type type;
···
104
103
void xb_deinit_comms(void);
105
104
int xs_watch_msg(struct xs_watch_event *event);
106
105
void xs_request_exit(struct xb_req_data *req);
106
+
void xs_free_req(struct kref *kref);
107
107
108
108
int xenbus_match(struct device *_dev, const struct device_driver *_drv);
109
109
int xenbus_dev_probe(struct device *_dev);
+4
-5
drivers/xen/xenbus/xenbus_comms.c
+4
-5
drivers/xen/xenbus/xenbus_comms.c
···
309
309
virt_wmb();
310
310
req->state = xb_req_state_got_reply;
311
311
req->cb(req);
312
-
} else
313
-
kfree(req);
312
+
}
313
+
kref_put(&req->kref, xs_free_req);
314
314
}
315
315
316
316
mutex_unlock(&xs_response_mutex);
···
386
386
state.req->msg.type = XS_ERROR;
387
387
state.req->err = err;
388
388
list_del(&state.req->list);
389
-
if (state.req->state == xb_req_state_aborted)
390
-
kfree(state.req);
391
-
else {
389
+
if (state.req->state != xb_req_state_aborted) {
392
390
/* write err, then update state */
393
391
virt_wmb();
394
392
state.req->state = xb_req_state_got_reply;
395
393
wake_up(&state.req->wq);
396
394
}
395
+
kref_put(&state.req->kref, xs_free_req);
397
396
398
397
mutex_unlock(&xb_write_mutex);
399
398
+1
-1
drivers/xen/xenbus/xenbus_dev_frontend.c
+1
-1
drivers/xen/xenbus/xenbus_dev_frontend.c
+8
-6
drivers/xen/xenbus/xenbus_probe.c
+8
-6
drivers/xen/xenbus/xenbus_probe.c
···
966
966
if (xen_pv_domain())
967
967
xen_store_domain_type = XS_PV;
968
968
if (xen_hvm_domain())
969
+
{
969
970
xen_store_domain_type = XS_HVM;
970
-
if (xen_hvm_domain() && xen_initial_domain())
971
-
xen_store_domain_type = XS_LOCAL;
971
+
err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v);
972
+
if (err)
973
+
goto out_error;
974
+
xen_store_evtchn = (int)v;
975
+
if (!v && xen_initial_domain())
976
+
xen_store_domain_type = XS_LOCAL;
977
+
}
972
978
if (xen_pv_domain() && !xen_start_info->store_evtchn)
973
979
xen_store_domain_type = XS_LOCAL;
974
980
if (xen_pv_domain() && xen_start_info->store_evtchn)
···
993
987
xen_store_interface = gfn_to_virt(xen_store_gfn);
994
988
break;
995
989
case XS_HVM:
996
-
err = hvm_get_parameter(HVM_PARAM_STORE_EVTCHN, &v);
997
-
if (err)
998
-
goto out_error;
999
-
xen_store_evtchn = (int)v;
1000
990
err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v);
1001
991
if (err)
1002
992
goto out_error;
+16
-2
drivers/xen/xenbus/xenbus_xs.c
+16
-2
drivers/xen/xenbus/xenbus_xs.c
···
112
112
wake_up_all(&xs_state_enter_wq);
113
113
}
114
114
115
+
void xs_free_req(struct kref *kref)
116
+
{
117
+
struct xb_req_data *req = container_of(kref, struct xb_req_data, kref);
118
+
kfree(req);
119
+
}
120
+
115
121
static uint32_t xs_request_enter(struct xb_req_data *req)
116
122
{
117
123
uint32_t rq_id;
···
243
237
req->caller_req_id = req->msg.req_id;
244
238
req->msg.req_id = xs_request_enter(req);
245
239
240
+
/*
241
+
* Take 2nd ref. One for this thread, and the second for the
242
+
* xenbus_thread.
243
+
*/
244
+
kref_get(&req->kref);
245
+
246
246
mutex_lock(&xb_write_mutex);
247
247
list_add_tail(&req->list, &xb_write_list);
248
248
notify = list_is_singular(&xb_write_list);
···
273
261
if (req->state == xb_req_state_queued ||
274
262
req->state == xb_req_state_wait_reply)
275
263
req->state = xb_req_state_aborted;
276
-
else
277
-
kfree(req);
264
+
265
+
kref_put(&req->kref, xs_free_req);
278
266
mutex_unlock(&xb_write_mutex);
279
267
280
268
return ret;
···
303
291
req->cb = xenbus_dev_queue_reply;
304
292
req->par = par;
305
293
req->user_req = true;
294
+
kref_init(&req->kref);
306
295
307
296
xs_send(req, msg);
308
297
···
332
319
req->num_vecs = num_vecs;
333
320
req->cb = xs_wake_up;
334
321
req->user_req = false;
322
+
kref_init(&req->kref);
335
323
336
324
msg.req_id = 0;
337
325
msg.tx_id = t.id;