Commit 05519f24 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'for-linus-6.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:

 - two minor cleanups

 - a fix of the xen/privcmd driver avoiding a possible NULL dereference
   in an error case

* tag 'for-linus-6.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  xen: move from strlcpy with unused retval to strscpy
  xen: x86: remove setting the obsolete config XEN_MAX_DOMAIN_MEMORY
parents 17b28d42 c5deb278
...@@ -14,7 +14,6 @@ CONFIG_CPU_FREQ=y ...@@ -14,7 +14,6 @@ CONFIG_CPU_FREQ=y
# x86 xen specific config options # x86 xen specific config options
CONFIG_XEN_PVH=y CONFIG_XEN_PVH=y
CONFIG_XEN_MAX_DOMAIN_MEMORY=500
CONFIG_XEN_SAVE_RESTORE=y CONFIG_XEN_SAVE_RESTORE=y
# CONFIG_XEN_DEBUG_FS is not set # CONFIG_XEN_DEBUG_FS is not set
CONFIG_XEN_MCE_LOG=y CONFIG_XEN_MCE_LOG=y
......
...@@ -581,27 +581,30 @@ static int lock_pages( ...@@ -581,27 +581,30 @@ static int lock_pages(
struct privcmd_dm_op_buf kbufs[], unsigned int num, struct privcmd_dm_op_buf kbufs[], unsigned int num,
struct page *pages[], unsigned int nr_pages, unsigned int *pinned) struct page *pages[], unsigned int nr_pages, unsigned int *pinned)
{ {
unsigned int i; unsigned int i, off = 0;
for (i = 0; i < num; i++) { for (i = 0; i < num; ) {
unsigned int requested; unsigned int requested;
int page_count; int page_count;
requested = DIV_ROUND_UP( requested = DIV_ROUND_UP(
offset_in_page(kbufs[i].uptr) + kbufs[i].size, offset_in_page(kbufs[i].uptr) + kbufs[i].size,
PAGE_SIZE); PAGE_SIZE) - off;
if (requested > nr_pages) if (requested > nr_pages)
return -ENOSPC; return -ENOSPC;
page_count = pin_user_pages_fast( page_count = pin_user_pages_fast(
(unsigned long) kbufs[i].uptr, (unsigned long)kbufs[i].uptr + off * PAGE_SIZE,
requested, FOLL_WRITE, pages); requested, FOLL_WRITE, pages);
if (page_count < 0) if (page_count <= 0)
return page_count; return page_count ? : -EFAULT;
*pinned += page_count; *pinned += page_count;
nr_pages -= page_count; nr_pages -= page_count;
pages += page_count; pages += page_count;
off = (requested == page_count) ? 0 : off + page_count;
i += !off;
} }
return 0; return 0;
...@@ -677,10 +680,8 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata) ...@@ -677,10 +680,8 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
} }
rc = lock_pages(kbufs, kdata.num, pages, nr_pages, &pinned); rc = lock_pages(kbufs, kdata.num, pages, nr_pages, &pinned);
if (rc < 0) { if (rc < 0)
nr_pages = pinned;
goto out; goto out;
}
for (i = 0; i < kdata.num; i++) { for (i = 0; i < kdata.num; i++) {
set_xen_guest_handle(xbufs[i].h, kbufs[i].uptr); set_xen_guest_handle(xbufs[i].h, kbufs[i].uptr);
...@@ -692,7 +693,7 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata) ...@@ -692,7 +693,7 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
xen_preemptible_hcall_end(); xen_preemptible_hcall_end();
out: out:
unlock_pages(pages, nr_pages); unlock_pages(pages, pinned);
kfree(xbufs); kfree(xbufs);
kfree(pages); kfree(pages);
kfree(kbufs); kfree(kbufs);
......
...@@ -1121,7 +1121,7 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op, ...@@ -1121,7 +1121,7 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
"%s: writing %s", __func__, state); "%s: writing %s", __func__, state);
return; return;
} }
strlcpy(phy, val, VSCSI_NAMELEN); strscpy(phy, val, VSCSI_NAMELEN);
kfree(val); kfree(val);
/* virtual SCSI device */ /* virtual SCSI device */
......
...@@ -40,7 +40,7 @@ static int frontend_bus_id(char bus_id[XEN_BUS_ID_SIZE], const char *nodename) ...@@ -40,7 +40,7 @@ static int frontend_bus_id(char bus_id[XEN_BUS_ID_SIZE], const char *nodename)
return -EINVAL; return -EINVAL;
} }
strlcpy(bus_id, nodename + 1, XEN_BUS_ID_SIZE); strscpy(bus_id, nodename + 1, XEN_BUS_ID_SIZE);
if (!strchr(bus_id, '/')) { if (!strchr(bus_id, '/')) {
pr_warn("bus_id %s no slash\n", bus_id); pr_warn("bus_id %s no slash\n", bus_id);
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment