1. 09 5月, 2007 11 次提交
  2. 05 5月, 2007 8 次提交
  3. 22 4月, 2007 5 次提交
  4. 20 4月, 2007 14 次提交
  5. 19 4月, 2007 2 次提交
    • A
      KVM: Fix off-by-one when writing to a nonpae guest pde · 6b8d0f9b
      Avi Kivity 提交于
      Nonpae guest pdes are shadowed by two pae ptes, so we double the offset
      twice: once to account for the pte size difference, and once because we
      need to shadow pdes for a single guest pde.
      
      But when writing to the upper guest pde we also need to truncate the
      lower bits, otherwise the multiply shifts these bits into the pde index
      and causes an access to the wrong shadow pde.  If we're at the end of the
      page (accessing the very last guest pde) we can even overflow into the
      next host page and oops.
      Signed-off-by: NAvi Kivity <avi@qumranet.com>
      6b8d0f9b
    • D
      [NETLINK]: Don't attach callback to a going-away netlink socket · ac57b3a9
      Denis Lunev 提交于
      There is a race between netlink_dump_start() and netlink_release()
      that can lead to the situation when a netlink socket with non-zero
      callback is freed.
      
      Here it is:
      
      CPU1:                           CPU2
      netlink_release():              netlink_dump_start():
      
                                      sk = netlink_lookup(); /* OK */
      
      netlink_remove();
      
      spin_lock(&nlk->cb_lock);
      if (nlk->cb) { /* false */
        ...
      }
      spin_unlock(&nlk->cb_lock);
      
                                      spin_lock(&nlk->cb_lock);
                                      if (nlk->cb) { /* false */
                                               ...
                                      }
                                      nlk->cb = cb;
                                      spin_unlock(&nlk->cb_lock);
                                      ...
      sock_orphan(sk);
      /*
       * proceed with releasing
       * the socket
       */
      
      The proposal it to make sock_orphan before detaching the callback
      in netlink_release() and to check for the sock to be SOCK_DEAD in
      netlink_dump_start() before setting a new callback.
      Signed-off-by: NDenis Lunev <den@openvz.org>
      Signed-off-by: NKirill Korotaev <dev@openvz.org>
      Signed-off-by: NPavel Emelianov <xemul@openvz.org>
      Acked-by: NPatrick McHardy <kaber@trash.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ac57b3a9